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THE  COURT:  Swear  in  the  jury  panel,  please. 

(A  jury  of  12  and  two  alternates  were  impaneled  and 

sworn ) 

THE  COURT:  Here's  how  we  are  going  to  proceed.  I  am 
going  to  read  some  preliminary  instructions  which  will  guide 
you  through  the  trial.  We'll  then  take  a  short  recess,  and  the 
parties  will  make  their  opening  statements,  and  then  we'll 
start  calling  witnesses. 

So,  after  I  give  you  the  instructions,  we'll  take  a 
short  break,  and  you'll  go  to  the  jury  room.  You  can  hang  up 
your  coats  and  you  give  Mr.  Gonzalez  your  contact  information 
and  we'll  give  you  our  contact  information,  so  we  can  stay  in 
touch  with  one  another,  if  anything  happens  that  you  want  to 
call  to  our  attention. 

But  ladies  and  gentlemen,  I  want  to  take  a  few  minutes 
now  to  give  you  some  initial  instructions  about  this  case  and 
about  your  duties  as  jurors.  After  all  the  evidence  is  in  and 
the  lawyers  have  summed  up,  I  will  give  you  final  instructions 
and  then  you  can  begin  your  deliberations.  I  may  also  give  you 
instructions  during  the  trial,  but  unless  I  specifically  tell 
you  otherwise,  all  such  instructions,  both  those  I  give  you  now 
and  those  I  give  you  later,  are  equally  binding  on  you  and  must 
be  followed. 

Your  duty  is  to  find  from  the  evidence  what  the  facts 
are.  You  and  you  alone  are  the  judges  of  those  facts,  and  then 
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1 

you  apply  the  law  as  I  give  it  to  you  to  the  facts  as  you  find 

2 

them  to  reach  your  verdict.  You  have  to  follow  the  law. 

3 

whether  or  not  you  agree  with  it . 

4 

Now,  please  remember  that  nothing  I  say  or  do  during 

5 

the  course  of  the  trial  is  intended  to  indicate  or  should  be 

6 

taken  by  you  as  indicating  what  your  verdict  should  be.  What 

7 

your  verdict  should  be  will  be  strictly  up  to  you. 

8 

I've  already  told  you  about  the  charges  alleged  in 

9 

this  case.  The  defendant,  Joshua  Schulte,  is  charged  in  11 

10 

counts  in  an  indictment  that  has  been  filed  by  a  grand  jury 

11 

sitting  in  this  district.  The  indictment  charges  that  in  or 

12 

about  2016,  the  defendant  allegedly  took  national  defense 

13 

information  from  the  CIA  computer  system  without  authorization. 

14 

and  transmitted  that  information  to  WikiLeaks,  which  posted  the 

15 

information  online  in  2017.  Those  charges,  the  WikiLeaks 

16 

charges,  account  for  seven  of  the  counts  in  the  indictment. 

17 

The  indictment  further  charges  Mr.  Schulte  with  one  count  of 

18 

unlawful  disclosure  and  attempted  disclosure  of  national 

19 

defense  information  while  he  was  in  the  Metropolitan  Correction 

20 

Center,  or  MCC,  a  federal  detention  center.  Finally,  the 

21 

indictment  charges  Mr.  Schulte  with  two  counts  relating  to 

22 

false  statements  he  made  allegedly  made  to  the  FBI  during  its 

23 

investigation,  and  one  count  related  to  his  alleged  violation 

24 

of  a  protective  order  entered  by  the  Court  in  2017.  The 

25 

government  must  prove  these  charges  in  the  indictment  beyond  a 
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reasonable  doubt. 

The  evidence  from  which  you  are  going  to  find  the 
facts  will  consist  of  the  testimony  of  witnesses  from  this 
witness  seat  right  here,  documents  and  other  things  that  will 
be  received  in  evidence,  and  occasionally  facts  that  the 
parties  may  agree  to,  which  we  call  "stipulations." 

Now,  certain  things  are  not  evidence,  and  you  should 
not  consider  them.  I  am  going  to  list  them  for  you.  First  of 
all,  attorneys'  arguments  are  not  evidence.  The  attorneys  are 
not  sworn  as  witnesses,  they  are  not  under  oath  and  do  not 
testify.  Attorneys'  statements  and  questions  are  not  evidence 
either . 

Let  me  emphasize  this  again:  It  is  not  the  question 
that  the  lawyer  asks.  What  is  important  is  the  witness's 
answer  to  the  question. 

Secondly,  objections  to  questions  are  also  not 
evidence.  It  is  the  duty  of  the  attorney  for  each  side  of  a 
case  to  object  to  the  other  side's  offers  of  testimony  or  other 
evidence  that  the  attorney  believes  is  not  properly  admissible. 
You  should  not  be  influenced  by  the  objection,  or  by  my  ruling 
on  it.  If  the  objection  is  sustained,  you  will  hear  me  say 
"sustained,"  then  you  should  ignore  the  question.  If  I 
overrule  the  objection,  then  you  should  treat  the  answer  just 
like  any  other  answer. 

My  job  is  to  rule  on  what  evidence  comes  in  at  the 
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trial,  but  I  have  no  view  on  what  your  verdict  should  be, 
because  that  is  strictly  up  to  you,  the  jury,  to  decide. 

If  I  instruct  you  that  some  items  of  evidence  are 
being  received  for  a  limited  purpose  only,  you  must  follow  that 
instruction,  as  you  must  follow  all  of  my  instructions.  Now, 
you  don't  have  to  worry  about  this  right  now,  there  may  not  be 
any  limiting  instructions  in  this  case.  But  if  there  is,  I 
will  explain  it  to  you  at  the  time  and  will  give  you 
instructions  as  clear  as  I  possibly  can  on  what  the  limitations 
are . 

I  may  well  tell  you  that  I'm  excluding  testimony  or 
tell  you  to  disregard  testimony.  When  I  do  that,  it  means  you 
have  to  follow  my  instructions  and  ignore  the  testimony  as  it's 
not  in  evidence . 

In  addition,  anything  you  may  see  or  hear  outside  this 
courtroom  is  not  evidence,  and  should  be  disregarded.  You  are 
to  decide  the  case  solely  on  the  admissible  evidence  that  is 
presented  here  in  the  courtroom. 

There  are  two  kinds  of  evidence  that  I  want  to  review 
with  you,  direct  evidence  and  circumstantial  evidence.  Direct 
evidence  is  the  direct  proof  of  a  fact.  An  example  of  that 
would  be  testimony  of  an  eyewitness,  somebody  who  actually  saw 
the  event  as  it  occurred.  Circumstantial  evidence  is  proof  of 
a  fact  or  facts  from  which  you  may  infer  or  conclude  that  other 
facts  exist.  Obviously  I  am  going  to  give  you  further 
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instructions  on  this  and  in  more  details  on  these  and  other 
matters  at  the  end  of  the  case,  but  just  keep  in  mind  that  you 
can  consider  both  kinds  of  evidence,  both  direct  and 
circumstantial . 

An  important  task  for  you  or  for  every  jury  is  to 
determine  the  credibility  of  the  witnesses.  And  it  is  going  to 
be  up  to  you  to  decide  which  testimony,  which  witnesses  to 
believe,  which  witnesses  not  to  believe,  and  how  much  of  any 
witness's  testimony  to  accept  or  reject.  Again,  in  my 
instructions  to  you  at  the  end  of  the  trial  I  will  give  you 
some  guidelines  which  I  hope  will  be  helpful  to  you  in 
determining  witness  credibility. 

Remember  what  we  discussed  earlier.  First,  law 
enforcement  witnesses'  testimony  gets  no  greater  or  lesser 
weight  because  of  their  law  enforcement  status.  Second, 
cooperating  witnesses  can  be  considered,  but  as  I  will  instruct 
you,  you  should  consider  their  testimony  with  great  care. 

This  is  a  criminal  case.  You  must  keep  in  mind  that 
there  are  three  basic  rules  about  criminal  law  that  you  always 
have  to  have  in  the  forefront  of  your  mind.  First  of  all,  the 
defendant  is  presumed  innocent.  Secondly,  the  government  has 
the  burden  of  proof.  Thirdly,  the  government  must  prove  its 
case  beyond  a  reasonable  doubt .  Let  me  go  through  each  of 
these  three  important  factors. 

First,  as  I  mentioned  to  you,  the  defendant  is 
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presumed  innocent  until  proven  guilty.  The  indictment  against 
the  defendant  brought  by  the  government  is  only  an  accusation 
and  nothing  more.  It  is  not  proof  of  guilt  or  anything  else. 
The  defendant,  therefore,  starts  out  with  an  absolutely  clean 
slate . 

Second,  the  burden  of  proof  is  on  the  government.  The 
defendant  has  no  burden  to  prove  his  innocence  or  to  present 
any  evidence  or  to  testify.  Since  he  has  right  to  remain 
silent,  the  law  prohibits  you  from  arriving  at  your  verdict  by 
considering  that  the  defendant  may  not  have  testified. 

Third,  the  government  must  prove  the  defendant's  guilt 
beyond  a  reasonable  doubt.  Again,  I  will  give  you  further 
detailed  instructions  on  this  point  later  in  the  case.  But 
bear  in  mind  that  in  this  respect,  a  criminal  case  is  different 
from  a  civil  case.  The  criminal  standard  of  proof  is  beyond  a 
reasonable  doubt.  In  a  civil  case  we  use  preponderance  of  the 
evidence.  But  here,  there  is  a  higher  burden,  and  it's  called 
the  burden  of  beyond  a  reasonable  doubt . 

From  time  to  time  during  the  trial  it  may  become 
necessary  for  me  to  talk  with  the  lawyers  out  of  the  hearing  of 
the  jury,  either  by  having  a  conference  at  the  bench  when  the 
jury  is  present  in  the  courtroom  —  that's  called  a  sidebar, 
you  have  seen  some  of  that  already  —  or  calling  a  recess. 
Please  understand  that  while  you  are  waiting,  we  are  working. 
The  purpose  of  any  conference  outside  your  viewing  is  not  to 
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keep  relevant  information  from  you,  but  to  decide  certain 
procedural  issues  and  how  certain  evidence  is  to  be  treated 
under  the  federal  rules  of  evidence  and  to  avoid  confusion. 

Now  just  a  few  words  about  your  own  conduct  as  jurors. 
First  of  all,  do  not  discuss  the  case  with  anyone  or  permit 
anyone  to  discuss  it  with  you.  Most  of  you  probably  use 
computers,  but  do  not  use  your  computers  to  do  any 
investigation  in  this  case.  My  instructions  to  not  discuss  the 
case  includes  discussing  the  case  in  person,  in  writing,  by 
phone  or  electronic  means,  via  text  message,  e-mail,  Facebook, 
Twitter,  blogging  or  any  other  form  of  social  media.  This  even 
includes  discussing  the  case  with  your  fellow  jurors  in  the 
jury  room  while  the  trial  is  going  on.  You  cannot  deliberate 
on  what  your  verdict  is  until  after  you've  been  charged  by  me, 
and  that  takes  place  at  the  end  of  the  trial.  Until  then,  you 
simply  cannot  talk  about  the  case.  So  you  can  talk  to  each 
other  about  almost  anything,  but  don't  talk  about  the  case. 

This  probably  seems  a  little  bit  strange  to  you. 

Here's  the  reason.  Obviously,  the  evidence  can  be  only  be 
presented  one  witness  at  a  time  and  one  exhibit  at  a  time.  We 
don't  want  you  to  start  talking  to  each  other  and  reaching 
conclusions  before  you  had  the  opportunity  to  see  and  hear  all 
of  the  evidence  in  the  case,  listen  to  the  lawyers'  summations, 
and  hear  my  instructions  on  the  law.  So  that  is  why  we  direct 
you  to  begin  your  deliberations  at  the  end,  and  until  that  time 
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not  to  have  any  discussions  about  this  case. 

Think  of  the  case  as  something  like  a  painting  when 
you  cannot  tell  from  one  stroke  or  one  color  what  the  painting 
will  look  like.  You  have  to  wait  until  it's  finished  to  make  a 
judgment,  and  that's  what  we  ask  you  to  do. 

If  at  any  time  during  the  course  of  the  trial  any 
person  attempts  to  talk  to  you  or  communicate  with  you  about 
the  case,  either  inside  or  outside  the  courthouse  —  and  I 
certainly  hope  that  doesn't  happen  —  you  should  immediately 
report  such  an  attempt  to  me.  Don't  bring  the  matter  to  the 
attention  of  any  other  jurors,  just  send  me  a  note  directly. 

In  the  same  way,  if  anything  should  happen  involving  any  of  you 
that  is  of  an  unusual  nature,  when  you  think  of  something  the 
Court  should  be  told  about,  do  not  discuss  it  with  any  other 
juror.  Simply  give  my  deputy,  Mr.  David  Gonzalez,  a  note  to 
that  effect  that  you  want  to  speak  to  me  about  it,  and  I  can 
hear  what  it  is  and  what  you  have  to  say.  Of  course,  I  do  not 
expect  anything  unusual  or  improper  to  happen.  But  if  it  does, 
bring  it  to  my  attention. 

Also,  lawyers  and  other  participants  at  the  counsel 
table  have  been  instructed  not  to  have  any  communication  with 
you  as  jurors.  That's  the  rule.  You  may  not  say  hello  or  even 
wave.  That  goes  for  you,  the  lawyers  and  the  witnesses.  In 
this  courthouse  you  may  see  people  in  the  elevators,  so  if  you 
run  into  one  another,  please  don't  acknowledge  them  or  expect 
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them  to  acknowledge  you.  They  are  under  instructions  not  to 
have  any  communication,  and  they  are  going  to  observe  that 
rule . 

If  at  any  point  in  the  trial  you  recognize  someone  in 
the  courtroom,  including  a  friend  or  family  member,  please  let 
me  know  immediately.  If  this  occurs  while  the  trial  is  in 
session,  please  simply  raise  your  hand. 

Please  don't  read  or  listen  to  anything  touching  upon 
this  case  in  any  way.  That  means  don't  read  any  newspaper 
publicity,  TV  news.  If  you  see  it,  ignore  it.  Don't  try  to  do 
any  research  on  your  own  or  conduct  your  own  investigation. 

This  means,  for  example,  that  you  should  not  consult  a 
dictionary,  search  the  internet,  website  or  blogs  or  use  any 
electronic  tools  to  obtain  information  about  this  case.  If  you 
see  something  about  the  case  in  the  newspaper,  you  must  not 
read  it.  You  must  avoid  watching  television  discussions  about 
this  case  or  issues  involved  in  this  case.  Your  sworn  duty  is 
to  decide  this  case  solely  and  wholly  on  the  evidence  presented 
in  this  courtroom. 

If  you  wish,  you  may  take  notes  while  the  evidence  is 
being  presented  to  you.  This  is  permitted  because  some  people 
find  that  taking  notes  helps  them  focus  on  the  testimony  being 
given.  You  should  not  try  to  summarize  the  testimony.  We  have 
excellent  court  reporters  who  take  down  everything  said 
throughout  the  trial.  Your  job  is  to  listen  to  the  testimony. 
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and  assess  the  credibility  of  the  witnesses.  If  do  you  take 
notes,  do  not  let  it  distract  you  from  your  task.  Moreover, 
your  notes  are  for  your  private  use  only  as  a  way  to  help  you 
recall  the  testimony  when  you  begin  your  deliberations.  Your 
notes  are  not  entitled  to  any  greater  weight  than  the 
recollection  of  a  juror  who  did  not  take  notes.  Finally,  you 
may  not  take  your  notes  away  from  the  courtroom.  Please  leave 
them  in  the  jury  room  at  the  end  of  each  court  day. 

Let  me  tell  you  again  how  important  your  service  is 
and  how  much  we  appreciate  it.  During  a  trial,  all  of  us  have 
to  be  here  before  any  work  can  be  done.  That  includes  the 
attorneys,  the  witnesses,  the  court  reporters,  the  judge,  and 
you  the  jury.  If  one  person  is  missing,  everything  stops. 
That's  what  makes  it  a  little  bit  different  than  work.  This  is 
not  a  situation  where  you  can  simply  call  in  sick.  There  are 
of  course  extraordinary  circumstances  that  may  excuse  you  from 
serving  on  this  jury.  But  in  all  other  circumstances,  we  need 
you  to  be  here  every  day,  and  as  best  you  can  on  time.  I 
understand  that  this  may  impose  a  burden,  but  as  I  have  said, 
this  is  an  important  public  service  and  one  that  is  greatly 
appreciated . 

I  start  my  trial  day  at  9  o'clock  in  the  morning 
except  for  Fridays  when  we'll  not  sit  for  trial.  About  a  half 
an  hour  before  we  start,  we'll  open  up  the  jury  room  and 
provide  you  with  a  light  breakfast.  We  also  provide  you  an 
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afternoon  snack  when  we  take  our  afternoon  break.  We  cannot 
provide  you  with  lunch. 

On  Monday  through  Thursday,  our  first  session  will  go 
from  9  in  the  morning  until  11:15,  at  which  point  we'll  take  a 
10  or  15  minute  break.  We'll  take  a  longer  break  of  about  30 
minutes  around  1  p.m.,  and  finish  the  day  at  3  o'clock.  The 
court  will  not  sit  for  trial  on  Fridays. 

Now,  here's  how  we're  going  to  proceed.  The 
government  will  make  an  opening  statement,  which  is  an  outline 
of  what  it  hopes  to  prove  and  to  help  you  understand  the 
evidence  as  it  comes  in.  Next,  the  defendant  may  make  an 
opening  statement,  but  he  does  not  have  to.  And  please 
remember,  as  you  listen  to  the  opening  statements  by  the 
lawyers,  that  these  statements  are  not  evidence.  Then  the 
government  will  start  presenting  witnesses  and  the  defense  may 
cross-examine  those  witnesses.  Following  the  government's 
case,  defendant  may,  if  he  wishes,  present  evidence,  but  he 
does  not  have  to  do  so.  After  all  the  evidence  is  in,  each 
side  has  the  opportunity  to  get  up  again,  present  their  closing 
arguments  to  you.  In  these  arguments  they're  going  to 
summarize  and  interpret  the  evidence  for  you,  and  then  of 
course  I  will  instruct  you  on  the  law.  After  all  that  is 
completed,  you'll  retire  to  begin  your  deliberations  on  this 
case . 

Now  for  some  housekeeping  matters.  You  probably 
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already  met  David  Gonzalez,  my  courtroom  deputy.  You're  going 

2 

to  be  working  with  Mr.  Gonzalez  who  will  greet  you  in  the 

3 

morning  and  make  sure  you're  escorted  in  and  out  of  the 

4 

courtroom.  He  will  give  you  the  notepads  if  you  want  to  take 

5 

notes.  If  you  have  any  troubles  or  problems,  please  see 

6 

Mr.  Gonzalez. 

7 

I  am  assisted  by  my  two  law  clerks,  Laura  King  and 

8 

Matthew  DeLuca,  and  my  court  reporters  are  Rebecca  Forman  and 

9 

Carol  Ganley. 

10 

That  concludes  my  preliminary  instructions.  We'll 

11 

take  our  morning  recess  now  for  about  15  minutes.  You  can  hang 

12 

up  your  coats  and  we'll  give  you  notepads  if  you  want  notepads. 

13 

then  we'll  resume  about  quarter  to  11.  Thank  you  very  much. 

14 

(Jury  excused) 

15 

THE  COURT:  Who  is  opening  for  the  government? 

16 

MR.  DENTON:  I  am,  your  Honor. 

17 

THE  COURT:  How  long  are  you  going  to  be? 

18 

MR.  DENTON:  15,  20  minutes  tops. 

19 

THE  COURT:  Ms.  Shroff,  who  is  opening  for 

20 

Mr.  Schulte? 

21 

MS .  SHROFF :  I  am,  your  Honor . 

22 

THE  COURT:  How  long  will  be  you  be? 

23 

MS.  SHROFF:  I  don't  know.  It  depends  on  what 

24 

Mr.  Denton  says,  but  between  7  and  10  minutes. 

25 

THE  COURT:  See  you  in  15  minutes. 
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(Recess ) 

(In  open  court;  jury  present) 

THE  COURT:  Mr.  Denton. 

MR.  DENTON:  Thank  you,  your  Honor. 

Ladies  and  gentlemen,  this  case  is  about  the  single 
biggest  leak  of  classified  national  defense  information  in  the 
history  of  the  CIA,  the  Central  Intelligence  Agency.  On 
March  7,  2017,  the  website  WikiLeaks  began  a  catastrophic 
public  disclosure  of  sensitive  national  security  secrets. 
Secrets  that  this  man,  Joshua  Schulte,  the  defendant,  stole 
from  a  top  secret  CIA  network.  Files  revealing  the  custom 
built  classified  cyber  tools  that  the  CIA  uses  in  our  national 
defense,  tracking  terrorists,  collecting  intelligence  overseas 
to  protect  the  United  States. 

The  leak  was  instantly  devastating.  Critical 
intelligence  gathering  operations  all  over  the  world  came  to  a 
crashing  halt.  CIA  officers  overseas  were  exposed.  Allies 
wondered  if  America  could  be  trusted  to  safeguard  intelligence 
they  shared  with  us.  Years  of  work  and  millions  of  dollars 
developing  those  tools  went  up  in  smoke,  because  secret  tools 
to  gather  intelligence  only  work  if  the  targets  don't  see  them 
coming.  And  now  those  tools  were  all  over  the  internet. 
Digital  weapons  we  had  built,  now  out  there  for  anyone  to  turn 
against  us . 

For  the  CIA,  it  was  the  ultimate  act  of  betrayal  by 
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one  of  their  own.  Joshua  Schulte  was  a  CIA  officer.  He  worked 
for  the  very  same  part  of  the  agency  that  created  the  national 
security  information  he  stole.  Joshua  Schulte  violated  his 
oath  to  protect  our  country  and  safeguard  those  secrets.  He 
violated  the  law. 

The  defendant  didn't  do  this  out  of  any  false 
idealism.  He's  not  some  kind  of  whistleblower.  He  did  it  out 
of  spite.  He  did  it  because  he  was  angry  and  disgruntled  at 
work.  He  did  it  to  start  what  he  in  his  own  words  called  "an 
information  war, "  a  war  against  the  CIA  he  felt  had  wronged 
him. 

His  information  war  didn't  stop  there.  He  continued 
to  wage  it  even  after  the  FBI  arrested  him  for  stealing  those 
top  secret  files.  From  jail,  he  got  an  encrypted  cell  phone, 
leaked  more  classified  information,  and  plotted  a  campaign  to 
send  even  more  CIA  secrets  to  WikiLeaks. 

What  Joshua  Schulte  did  wasn't  just  revenge,  ladies 
and  gentlemen,  it  was  a  crime.  And  that's  why  we're  here 
today . 

The  evidence  in  this  trial  will  prove  the  defendant 
create  committed  serious  federal  crimes,  crimes  of  espionage, 
stealing  secrets  from  the  CIA.  The  evidence  will  prove  that  he 
tried  to  commit  more  espionage  by  leaking  even  more  secrets 
from  his  jail  cell.  It  will  prove  crimes  of  computer  hacking 
when  he  broke  into  parts  of  the  CIA's  network.  It  will  prove 
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that  the  defendant  obstructed  justice,  lied  to  the  FBI,  and 
violated  orders  of  this  Court. 

As  Judge  Crotty  said,  over  the  next  few  minutes  I ' 11 
give  you  a  preview  of  what  the  evidence  in  this  trial  will 
show.  Evidence  that  you  will  see  in  this  man's  own  words,  hear 
from  his  co-workers,  reading  in  logs  of  his  computer  hacking. 
Evidence  that  will  fit  together  to  reveal  the  whole  truth  about 
this  man's  crimes. 

You'll  learn  that  Joshua  Schulte  used  to  work  as  a 
software  developer,  in  an  elite  group  at  the  CIA  where 
programmers  built  sophisticated  cyber  tools  to  support  national 
defense  and  intelligence  operations  overseas.  Schulte  and  his 
fellow  CIA  officers  in  that  group  worked  in  a  secret  building, 
protected  by  armed  guards,  accessed  using  special  badges  and 
codes,  inside  offices  that  are  literally  vaults,  combination 
locks  on  the  doors.  Everyone  who  worked  there  had  a  top  secret 
security  clearance  vetted  by  CIA  investigators  to  be  sure  that 
they  could  be  trusted  with  the  precious  secrets  of  our  national 
defense . 

Behind  those  armed  guards,  those  combination  locks, 
those  vault  doors,  Schulte's  group  used  a  secret  CIA  computer 
network  to  develop  their  cyber  tools.  It  wasn't  just  a  secret 
network;  it  was  a  special  one.  For  Schulte  and  the  other 
developers  to  be  able  to  perform  their  work,  the  network  gave 
them  freedom  to  design  cyber  tools,  to  share  information,  to 
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work  together.  Their  work  was  to  exploit  vulnerabilities  in 

2 

the  computers  of  America's  adversaries,  so  their  network  had  to 

3 

be  set  up  to  let  them  do.  In  order  for  the  system  to  work,  the 

4 

CIA  had  to  be  able  to  trust  that  group  of  elite  programmers. 

5 

In  2015,  Joshua  Schulte  was  given  a  special  level  of 

6 

trust  within  the  CIA.  He  was  made  a  system  administrator  for 

7 

software  on  the  CIA's  developer's  network.  As  you'll  hear  him 

8 

say  on  tape,  he  had  super  access.  The  kind  of  access  normal 

9 

developers  didn't  have.  The  kind  of  access  that  let  him 

10 

control  all  of  the  sensitive  intelligence  projects  on  that 

11 

network,  and  even  let  him  control  who  else  had  access  to  those 

12 

project.  As  an  administrator,  Schulte  helped  make  backups  of 

13 

the  systems  that  he  and  the  other  programmers  worked  on. 

14 

Backups  that  were  saved  every  day  in  case  of  some  catastrophe 

15 

that  meant  the  system  had  to  be  restored.  But  the  real 

16 

catastrophe  was  Joshua  Schulte,  because  he  breached  the  special 

17 

trust  the  CIA  placed  in  him. 

18 

Why  did  he  do  it?  Why  did  Joshua  Schulte  start  an 

19 

information  war?  Because  he  was  angry.  You'll  learn  that  in 

20 

2015  and  2016,  Schulte  started  having  problems  at  work.  He  got 

21 

into  arguments,  personal  disputes  with  other  people  in  his 

22 

branch.  And  you  will  learn  that  when  of  those  arguments  got 

23 

out  of  hand,  Schulte  decided  to  retaliate  against  another 

24 

developer,  by  falsely  accusing  his  co-worker  of  threatening  to 

25 

kill  Schulte.  Now,  the  CIA  investigated  that  allegation 
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thoroughly  and  determined  it  was  baseless.  But  that  just  made 
Schulte  mad.  Even  when  the  CIA  decided  to  separate  Schulte  and 
his  co-worker  by  reassigning  them  to  different  branches,  he 
just  became  angry.  Angry  at  his  bosses,  angry  at  the  whole 
agency,  angry  that  the  CIA  didn't  take  his  side.  So  he  started 
breaking  the  rules.  Critical  rules  that  limit  access  to 
sensitive  national  security  secrets.  Rules  that  Joshua  Schulte 
didn't  think  should  apply  to  him.  So  he  abused  the  trust  that 
he  had  been  given  as  an  administrator,  secretly  used  his  super 
access  to  give  himself  control  over  sensitive  projects  he  had 
expressly  been  told  he  wasn't  allowed  to  have. 

Now,  you  won't  be  surprised  to  learn  that  his  network 
tampering  set  off  alarm  bells  at  the  CIA.  The  agency  found  out 
what  Schulte  had  done,  and  it  was  such  a  serious  violation, 
that  the  CIA  decided  they  had  to  lock  down  the  top  secret 
network  that  he  had  accessed.  So  they  changed  passwords,  they 
tried  to  take  away  his  super  access,  but  they  left  a  back  door 
unlocked.  A  back  door  Schulte  knew  about.  Schulte  got  a 
warning  about  what  he  had  done  from  his  supervisors  at  the  CIA. 
They  told  him  they  knew  he  had  abused  his  access,  and  he 
admitted  it.  He  signed  a  memo  agreeing  never  to  do  it  again. 
They  ordered  Schulte  to  verify  that  he  no  longer  had  that  super 
access,  and  what  did  he  do?  He  lied.  You'll  see  that  at  the 
very  moment  that  he  sent  an  e-mail  saying  that  he  had  checked, 
he  had  no  more  super  access,  he  knew  that  back  door  was  still 
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open . 

Two  days  later,  Schulte  was  told  that  parts  of  the  top 
secret  system  he  worked  on  were  going  to  be  moved  on  to  a  new 
server.  That  was  important  news  for  Schulte.  Because  when 
those  programs  moved  on  to  a  new  server,  that  back  door  to  his 
secret  access  was  going  to  be  shut.  And  so  the  evidence  will 
show  that  that  day,  on  the  evening  of  April  20,  2016,  Joshua 
Schulte  stole  the  preciously  guarded  national  security  secrets 
that  WikiLeaks  later  posted  on  the  Internet.  On  the  evening  of 
April  20,  Schulte  used  that  back  door,  access  he  knew  he  wasn't 
supposed  to  have,  to  do  something  called  a  reversion.  Kind  of 
like  restoring  a  phone.  He  used  a  backup  copy  to  take  the 
system  back  in  time  to  before  the  CIA  tried  to  lock  down  the 
system.  Back  to  a  time  when  Schulte  had  total  administrative 
control.  For  over  an  hour,  from  the  computer  sitting  at  his 
desk  at  CIA,  Schulte  was  in  that  system  secretly  restoring  his 
super  access,  giving  himself  back  all  the  control  he  had  before 
it  was  taken  away.  Restoring  his  access  to  the  backups  that 
stored  copies  of  the  entire  system. 

Remember  that  every  day  the  CIA  backed  up  all  the 
critical  work  that  Schulte  and  the  other  developers  were  doing, 
so  that  if  something  happened,  it  won't  be  lost  forever.  Same 
way  you  back  up  a  hard  drive  in  case  your  computer  crashes. 

And  the  evidence  will  show  that  shortly  after  Schulte 
had  broken  back  into  the  system,  he  stole  an  entire  backup,  a 
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copy  of  all  those  secrets.  And  not  just  any  backup,  actually 
one  that  meant  something  to  him.  He  stole  the  backup  from 
March  3,  2016,  the  very  day  that  Schulte  felt  the  CIA  had 
wronged  him,  by  dismissing  his  false  accusations  against  his 
co-worker.  The  exact  backup,  the  exact  secrets,  put  out  by 
WikiLeaks . 

After  stealing  the  backup,  Schulte  tried  to  cover  his 
tracks.  During  that  hour  on  April  20,  when  he  took  the  system 
back  in  time,  Schulte  started  carefully  deleting  every  log  file 
that  kept  track  of  what  he  had  done  while  he  was  in  the  system. 
After  destroying  that  evidence,  he  unwound  the  reversion. 
Schulte  restored  the  system  to  how  it  had  been  just  before  he 
hacked  in,  erasing  that  hour  of  time  as  if  it  hadn't  existed. 
Trying  to  cover  his  tracks,  that  proved  how  he  stole  our 
nation's  secrets. 

The  evidence  will  prove  that  Schulte  sent  that  stolen 
classified  backup,  a  copy  of  all  the  sensitive  projects  of  the 
CIA's  programming  group,  to  WikiLeaks.  Because  the  very  same 
backup  that  he  stole  that  day,  was  exactly  what  WikiLeaks 
posted  on  the  internet . 

And  in  the  days  that  followed  April  20,  Schulte 
started  doing  everything  he  needed  to  do  to  send  that  stolen 
backup  to  WikiLeaks.  He  downloaded  programs  on  his  home 
computer  that  let  him  hide  his  identity  on  the  internet.  He 
bought  computer  equipment  to  copy  hard  drives  and  transfer  data 
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without  leaving  a  record  on  a  computer.  He  researched  how  to 
verify  if  huge  files  had  transferred  successfully  over  the 
internet,  and  how  to  destroy  evidence  at  home,  the  same  way  he 
did  at  the  CIA,  like  when  he  downloaded  a  program  to  nuke  his 
hard  drive. 

And  you  will  see  that  when  all  was  said  and  done,  two 
weeks  after  his  digital  break  in  at  the  CIA,  after  he  had  sent 
that  precious  trove  of  national  defense  information  to 
WikiLeaks,  Schulte  tried  to  completely  reformat  his  entire  home 
computer.  He  did  it  in  another  attempt  to  wipe  the  computer 
clean  of  any  remaining  evidence. 

And  you'll  learn  that  those  things  Schulte  did  on  his 
home  computer  are  exactly  what  WikiLeaks  tells  people  to  do 
when  transmitting  stolen  secrets. 

A  few  unhappy  months  later,  Schulte  finally  resigned 
from  the  CIA.  He  took  a  job  here  in  New  York.  And  he  was  here 
on  March  7,  2017,  when  WikiLeaks  started  to  post  the  sensitive 
national  security  information  that  he  stole. 

After  the  leak  went  public,  the  FBI  immediately 
started  to  investigate.  Agents  interviewed  hundreds  of  people, 
including  Schulte. 

(Continued  on  next  page) 
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MR.  DENTON:  And  Joshua  Schulte  thought  he  could  do 
the  same  thing  that  he  tried  to  do  at  the  CIA,  talk  his  way  out 
of  it.  And  so  he  lied  again.  Lied  to  the  FBI.  Tried  to 
obstruct  the  investigation  by  sending  them  down  false  paths. 

But  the  evidence  will  show  that  when  that  didn't  work  and 
Schulte  was  arrested  and  put  in  jail  to  stand  trial,  he  decided 
to  escalate  his  information  war.  He  got  an  encrypted  cell 
phone  in  jail,  started  writing  a  report,  promising  to  give  them 
classified  information.  He  created  accounts  on  social  media  to 
post  articles  he  had  written  that  had  more  secrets  in  them. 

The  evidence  will  show  that  Joshua  Schulte  was  so 
desperate  to  wage  his  information  war  that  he  even  violated  a 
court  order  to  conduct  it.  Twice.  And  after  this  judge 
specifically  told  him  not  to,  he  sent  more  sensitive  material 
from  the  government  to  a  reporter.  In  notebooks  he  kept  in 
jail,  he  wrote  a  detailed  battle  plan  for  the  next  campaign  in 
his  information  war.  But  before  Schulte  could  launch  that  new 
campaign,  the  FBI  caught  him  in  the  act.  They  searched  the 
prison.  They  found  his  secret  phone.  They  found  his  written 
plan  to  destroy  evidence  and  leak  secrets,  and  they  put  a  stop 
to  it,  preventing  Schulte  from  spilling  even  more  of  our  most 
preciously  guarded  intelligence. 

Now,  ladies  and  gentlemen,  that  is  just  an  overview  of 
what  the  evidence  in  this  trial  is  going  to  prove.  Let  me  say 
a  little  bit  about  how  we're  going  to  prove  it,  because  the 
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evidence  is  going  to  come  in  many  forms.  You'll  hear  testimony 
from  several  different  kinds  of  witnesses,  like  Schulte's 
coworkers  at  the  CIA,  covert  officers  responsible  for 
developing  those  cyber  tools.  They'll  tell  you  about  their 
group  and  its  important  work  for  our  national  defense  and  about 
that  secret  network  they  used  to  do  that  work.  They'll  talk 
about  Schulte's  arguments  in  the  workplace,  his  spiral  out  of 
control,  his  quest  for  revenge.  They'll  talk  about  how  they 
found  Schulte's  abuses  of  his  administrative  control  on  their 
secret  network,  his  violations  of  the  trust  necessary  to  do 
their  vital  work,  and  how  they  tried  to  keep  him  from  doing  it 
again . 

You're  also  going  to  hear  from  agents,  experts,  from 
the  FBI  who  investigated  Schulte's  crimes,  specialists  in  cyber 
crimes,  digital  forensics,  counterintelligence.  They'll  tell 
you  about  the  investigation.  You'll  learn  from  these  witnesses 
that  the  FBI  analyzed  the  classified  information  that  was 
posted  on  WikiLeaks  and  they  compared  it  to  what  was  on  that 
CIA  network,  and  you'll  see  how  they  determined  that  the  stolen 
information  posted  by  WikiLeaks  came  from  one  spot,  that  same 
specific  March  3  backup  of  the  system,  the  very  backup  that 
Schulte  stole,  a  backup  that  very  few  people  knew  where  it  was 
or  even  that  it  existed.  But  you'll  learn  that  Joshua  Schulte 
knew  exactly  about  it  because  he  helped  create  it  and  so  he 
knew  exactly  how  to  steal  it. 
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Those  forensic  experts  will  also  walk  you  through  what 
Schulte  did  on  April  20,  2016,  the  day  he  stole  those  secrets. 
Even  though  Schulte  tried  to  delete  any  trace  of  his  theft  of 
sensitive,  classified  information,  his  footprints  were  left 
behind.  The  FBI's  experts  found  them  in  the  recesses  of  the 
computer  memory  of  Schulte's  own  desktop  at  the  CIA,  in  spaces 
where  bits  of  data  stayed  behind  even  when  Schulte  tried  to 
erase  them. 

You're  also  going  to  see  a  lot  of  exhibits,  things 
like  documents  and  physical  evidence.  For  example,  you'll  see 
emails  and  all  the  records  of  Schulte's  personnel  disputes  at 
the  CIA  and  the  things  the  CIA  did  to  try  and  address  them. 
You'll  see  the  log  files  from  Schulte's  own  computer  showing 
him  sending  the  commands  to  take  their  classified  system  back 
in  time  to  get  his  access  back,  to  delete  evidence  of  what  he 
had  done,  to  undo  his  reversion  to  make  it  seem  like  it  never 
happened.  You'll  see  data  about  that  March  3  backup  for  the 
exact  source  of  the  national-security  secrets  posted  on  the 
internet,  showing  that  the  last  time  anyone  accessed  that  file 
on  the  CIA's  network  was  the  evening  of  April  20,  2016,  right 
in  the  middle  of  Schulte's  digital  break-in. 

You'll  see  video  of  Schulte  when  he  was  in  jail  using 
that  secret,  smuggled  cell  phone.  You'll  read  encrypted  emails 
he  wrote  to  a  reporter  attaching  classified  information  and 
documents  that  Schulte  had  been  ordered  by  the  Court  not  to 
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disclose . 

And  finally,  you're  going  to  see  and  hear  Joshua 
Schulte's  own  words.  You'll  watch  the  defendant  admit  on  video 
to  having  abused  his  administrative  access,  and  you'll  see  him 
declare  to  a  CIA  investigator  that  he  wanted  his  supervisors  to 
be  punished  for  the  ways  that  he  thought  they  had  wronged  him. 
You'll  read  notebooks  that  the  defendant  wrote  in  jail,  his 
plans  for  disclosing  even  more  sensitive  national-defense 
information  and  long  drafts  he  wrote  of  what  he  was  planning  to 
disclose,  drafts  he  wrote  revealing  secret  CIA  bases  and 
operations  conducted  by  the  CIA  overseas,  precious  technical 
details  about  the  way  the  CIA  collects  intelligence  on 
America's  adversaries,  all  written  by  Schulte  as  part  of  his 
plan  for  leaking  to  the  world. 

And  you'll  read  in  his  own  words  his  plan  for 
information  war,  things  he  wrote,  like  "I  will  look  to  break  up 
diplomatic  relationships,  close  embassies";  things  he  wrote, 
like,  "Top  secret?  Fuck  your  top  secret";  and  things  like, 
"Send  all  your  government  secrets  here,  WikiLeaks." 

Now,  as  I  said,  and  Judge  Crotty  told  you  as  well, 
this  is  just  a  preview  to  give  you  some  context  for  what  you're 
going  to  see  and  hear  over  the  next  few  weeks.  At  the  end  of 
this  trial,  after  all  the  testimony  is  in  and  the  exhibits  have 
been  received,  we'll  get  another  opportunity  to  talk  to  you 
about  how  the  evidence  specifically  proves  the  defendant's 


SOUTHERN  DISTRICT  REPORTERS,  P.C. 
(212)  805-0300 


1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 


26 

K24Wsch2  Opening  -  Ms.  Shroff 

guilt.  And  after  that  Judge  Grotty's  going  to  instruct  you  on 
the  law.  For  now,  I'm  just  going  to  ask  you  to  do  three 
things . 

First,  pay  close  attention  to  all  the  evidence. 

Second,  carefully  follow  any  instructions  Judge  Grotty 
gives  you  on  the  law. 

And  finally,  just  use  your  common  sense,  the  same 
common  sense  you  use  every  day  to  size  people  up,  make 
decisions.  Apply  that  common  sense  when  you  assess  the 
evidence  that  you're  going  to  see  and  hear  here.  If  you  do 
those  three  things,  you  will  give  Joshua  Schulte  a  fair  and  a 
just  trial.  And  if  you  do  those  three  things,  you  will  reach 
the  only  conclusion  that  is  supported  by  all  that  evidence, 
that  the  defendant  is  guilty. 

Thank  you . 

THE  GOURT :  Thank  you,  Mr.  Denton. 

Ms.  Shroff. 

MS.  SHROFF:  The  evidence  does  not  fit.  There  is  no 
battle  plan.  There  is  no  information  war.  The  prosecution 
here  simply  has  it  wrong.  Mr.  Schulte  has  not  committed  these 
crimes,  and  at  the  end  of  the  day,  you  will  see  that  he  is  not 
guilty . 

Good  morning,  ladies  and  gentlemen.  Along  with 
Mr.  Zas  and  Mr.  Branden,  we  represent  Mr.  Schulte,  and  I'm  here 
to  tell  you  what  really  happened  on  March  7  of  2017,  and  the 
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time  frame  before  that. 

On  March  7,  2017,  a  trove  —  literally  thousands  and 
thousands  —  of  documents,  CIA  documents,  CIA  information, 
showed  up  on  WikiLeaks.  As  you  just  heard  the  prosecutor  say, 
these  documents  were  important  to  the  CIA.  These  documents 
were  about  the  CIA's  secret  electronic  surveillance  programs, 
documents  that  the  CIA  never  wanted  the  world  to  know  about  and 
certainly  not  documents  that  they  would  want  published  on 
WikiLeaks . 

This  was  front-page  news.  It  was  front-page  news  all 
over  the  world,  and  it  was  news  to  the  CIA.  The  CIA  had  no 
idea  —  no  idea  at  all  —  how  these  documents  were  leaked. 

They  did  not  know  how,  they  did  not  know  when,  they  did  not 
know  why,  and  they  certainly  did  not  know  who  had  done  it. 

Just  bear  in  mind  the  first  time  they  find  out  is  on  March  7, 
2017.  And  the  reality  is,  today,  the  CIA  still  doesn't  know 
these  things,  and  nor  does  the  government. 

At  the  time  of  the  leak  and  ever  since,  there  was 
tremendous  pressure,  nothing  but  heat  and  pressure,  to  hold 
someone  responsible,  someone  responsible  for  this  leak,  someone 
to  blame,  someone  to  whom  the  government  can  point  the  finger, 
to  take  the  heat  off  the  CIA  for  not  knowing  how  these 
documents  ended  up  on  WikiLeaks.  So  the  CIA  blamed  Josh 
Schulte.  He's  an  easy  lay-up  for  them,  you  will  see.  The 
evidence  will  show  he's  an  easy  target  and  an  easy  lay-up  for 
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the  CIA.  But  they're  wrong.  Mr.  Schulte  is  innocent,  and 
throughout  this  trial,  you  will  come  to  that  same  conclusion. 

I  remind  you  now,  as  Judge  Grotty  will  remind  you 
again,  Mr.  Schulte  does  not  bear  any  burden  of  proof.  He  does 
not  have  to  prove  to  you  that  he's  innocent.  It  is  the 
government's  burden  to  prove  to  you,  beyond  all  reasonable 
doubt,  that  he  is  guilty  of  each  one  of  the  11  counts  he  is 
charged  with,  and  they  will  never  be  able  to  do  it  because 
Mr.  Schulte  is  simply  not  guilty.  After  almost  three  years, 
this  massive  CIA  leak  still  remains  a  mystery,  a  mystery  of  who 
did  it,  how  it  was  done,  when  it  was  done. 

You  see,  the  CIA  had  to  work  backwards  to  go  back  and 
try  to  explain,  try  to  figure  out  exactly  how  these  documents 
were  copied,  how  they  were  taken,  how  they  were  taken  out  of 
the  CIA's  system  without  anyone  knowing  how  they  got  to 
WikiLeaks  and  when  and  why  it  happened.  You  will  hear  the 
government  try  to  piece  together  a  string  of  facts,  and  you 
will  see  that  they  will  not  be  able  to  give  you  credible 
evidence  that  Mr.  Schulte  is  the  one  who  did  this. 

So  let's  start  with  how.  The  first  question  is  how. 

You're  going  to  learn  that  the  CIA  and  the  FBI  still 
don't  know  how.  You've  heard  now  Mr.  Denton  say  that  these 
documents  were  kept  under  lock  and  key;  they  were  so  secure 
that  the  CIA's  computer  system  and  the  CIA's  building  were 
guarded,  and  its  system,  which  is  called  the  DEVLAN  system,  was 
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super  secret. 

It  wasn't.  It  simply  wasn't.  The  CIA's  DEVLAN  system 
was  not  adequately  protected.  In  fact,  it's  quite  the 
opposite.  It  was  wide  open,  wide  as  the  Sargasso  Sea,  and  when 
you  hear  from  the  CIA  witnesses,  you  will  hear  it  was  called 
the  wide,  wide  west.  People  who  worked  at  the  CIA  knew  it 
wasn't  a  protected  system.  It  was  a  system  that  allowed 
hundreds  of  CIA  employees  to  have  access,  not  just  CIA 
employees  but  third  parties  and  individuals  who  contracted  with 
the  CIA,  who  contracted  with  the  CIA  to  do  work  for  the  CIA. 

And  this  is  not  even  to  mention  the  many  foreign  countries  and 
the  many  foreign  agents  who  all  vie  with  each  other  —  and  we 
all  know  this,  they  all  vie  with  each  other  to  try  and  get  each 
others'  information. 

And  it  isn't  just  that  the  system  was  unprotected, 
that  it  wasn't  super  secure  or  even  adequately  secure;  it's 
that  everybody  knew  that  it  wasn't  secure.  People  at  the  CIA 
knew  that  the  computer  system  was  wide  open;  it  lacked 
controls,  and  any  one  of  these  people  —  literally  hundreds  of 
people,  any  one  of  these  people  could  have  and  did  have  the 
opportunity  to  take  that  information.  And  remember  again  that 
information  had  been  gone  for  almost  a  year  before  the  CIA  even 
realized  that  it  had  been  gone,  that  it  had  been  taken.  For 
God's  sakes,  a  whole  year.  They  went  a  whole  year  without 
knowing  that  their  super-secure  system  had  been  hacked. 
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In  the  prosecution's  opening,  they  gave  you  a  theory. 
They  told  you  this  is  how  they  think  Josh  Schulte  took  it. 

This  is  how  they  think  Josh  Schulte  stole  the  information,  and 
that  is  what  it  is.  It's  their  theory.  It  does  not  come  with 
proof  beyond  a  reasonable  doubt.  And  more  than  that,  you  will 
see  as  the  evidence  unfolds  that  this  is  pure  speculation  on 
their  part. 

Let's  talk  about  when  this  happened. 

Does  the  government  even  know  when  this  happened? 

They  claim  to,  but  let's  just  examine  that.  All  they  know  is 
WikiLeaks  published  the  information  on  March  7,  2017.  The 
government's  theory  is  that  the  information  was  stolen  almost  a 
year  before  that,  leaked  to  WikiLeaks,  and  for  a  whole  year, 
WikiLeaks  just  sat  on  the  information.  The  government  wants 
you  to  believe  that  this  information  —  this  is  national 
defense  information  that  everybody  wanted,  that  the  CIA  worked 
so  very  hard  to  keep  secret  —  was  released  to  WikiLeaks  and 
WikiLeaks  sat  on  that  information  —  sensational,  mind-blowing, 
news-creating  information  —  for  a  year.  Does  that  make  any 
sense  to  you?  An  organization  that  wants  to  spread 
information,  give  out  the  news,  sits  on  information  for  a  whole 
year . 

When  you  have  an  explosive  story,  think  about  The  New 
York  Times  or  The  Wall  Street  Journal,  they  have  a  mind-blowing 
story,  do  they  sit  on  it  for  a  year?  It  makes  no  sense.  You 
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do  not  sit  on  information  to  go  stale  for  a  year.  You  release 
the  information  you  have. 

Not  only  is  the  government's  story  implausible,  it 
keeps  changing.  And  you  will  hear  about  this.  You  will  hear 
that  the  government  and  the  FBI  agents  first  said  that  the  data 
was  taken  from  the  CIA  in  March  of  2016.  They  identify  for  you 
a  very  specific  time  period  of  when  they  think  this  data  was 
stolen,  March  7th  or  8th  of  2016.  But  now  they  will  tell  you, 
and  now  they  have  told  you,  in  fact,  that  their  first  theory 
was  wrong. 

You  just  heard  the  prosecutor  say  that  the 
information,  according  to  him,  was  stolen  in  April.  In  fact, 
he  gives  you  a  very  specific  date:  April  20  of  2016.  So  which 
one  is  right?  Was  it  March?  Was  it  April?  They  don't  know. 
They  do  not  know,  and  you  will  learn  that  the  CIA  actually  has 
no  idea  when  this  information,  when  this  data  was  taken  from 
the  CIA.  And  I  remind  you  yet  again  that  but  for  WikiLeaks's 
publication  of  this  data,  it  is  likely  that  the  CIA  even  today 
would  not  know  that  their  data  was  taken. 

So  that  brings  us  to  the  last  questions,  the  questions 
at  the  heart  of  this  case:  who  and  why?  Lots  of  people  —  lots 
of  people  —  at  the  CIA,  very  sophisticated,  clever,  smart 
computer  nerds  just  like  Mr.  Schulte  have  all  the  skill  set  to 
do  exactly  what  the  government  tells  you  to  believe  Mr.  Schulte 
did.  I  want  to  remind  you  again  and  again  that  the  CIA  itself 
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1  has  no  sense  of  what  exactly  was  taken.  So  do  they  tell  you 

2  who  and  why?  No.  They  work  backwards  and  they  find  someone  to 

3  blame,  and  they  need  to  blame  someone  quickly  because  they've 

4  sat  on  this,  looked  foolish  for  not  having  realized  for  over  a 

5  year  that  their  crown  jewels  were  stolen. 

6  You  think  the  CIA  can  just  say  a  year  later:  "Oops. 

7  Sorry.  We  messed  up.  We  don't  know  how  this  got  out  there. 

8  Forgive  us,  and  let's  all  move  on"?  No.  Obviously  they 

9  cannot.  So  what  do  they  say?  They  say  it  was  Josh  Schulte, 

10  because  as  I've  already  mentioned  to  you,  he  is  an  easy  target. 

11  Why?  He's  an  easy  target  because  when  he  worked  for 

12  the  CIA,  he  antagonized  almost  every  single  person  there.  He 

13  antagonized  his  colleagues.  He  antagonized  management.  He  was 

14  a  difficult  employee.  He  really  was  a  difficult  employee,  but 

15  being  a  difficult  employee  does  not  make  you  a  criminal.  A 

16  difficult  employee  does  not  translate  to  being  a  traitor.  A 

17  difficult  employee  does  not  translate  to  somebody  who  would 

18  sell  out  their  country.  Josh  Schulte's  not  a  traitor. 

19  So,  for  a  minute,  let  me  just  talk  to  you  about  who 

20  Josh  Schulte  is.  Mr.  Schulte  was  born  in  September  of  1988. 

21  He  was  born  in  Lubbock,  Texas.  He's  30  years  old.  He's  one  of 

22  four  boys  born  to  Roger  and  Deanna  Schulte. 

23  From  a  young  age,  Mr.  Schulte  showed  a  strong  interest 

24  in  math  and  computers.  He  was  a  smart  kid,  and  he  really 

25  wanted  to  serve  his  country.  He  went  to  University  of  Texas, 
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applied  for  an  internship  and  was  an  intern  at  the  NSA,  the 
National  Security  Agency.  His  dream  was  to  be  hired  by  the 
CIA,  and  in  2010,  his  dream  came  true.  He  was  hired  by  the 
CIA.  He  worked  on  developing  programs  in  counterterrorism.  He 
did  important  work,  tracking  down  terrorists;  wrote  programs 
and  tools  to  enable  the  United  States  to  get  rid  of  terrorists. 
By  all  accounts,  he  was  talented.  He  was  a  talented, 
hardworking  employee,  and  he  worked  on  some  important  CIA 
projects . 

He  was  also  a  pain  in  the  ass  to  everybody  at  the  CIA, 
and  by  the  middle  of  2016,  Mr.  Schulte  became  very  dissatisfied 
with  his  job  and  his  colleagues  and  his  management  at  the  CIA. 
He  had  disputes  with  his  colleagues.  He  didn't  like  the 
disputes.  He  didn't  like  the  colleague.  He  complained  to 
management.  Management  took  the  colleague's  side,  and  yes, 

Mr.  Schulte  was  unhappy  about  that,  so  unhappy  that  he 
eventually  decided  he  was  going  to  leave  his  dream  job  and  move 
on.  And  he  moved  on.  He  found  a  job  with  Bloomberg.  He  left 
the  CIA,  moved  to  New  York,  and  that  was  in  November  of  2016, 
November  10,  2016,  four  months  before  there's  any  leak  of  this 
information  onto  WikiLeaks. 

Unlike  the  CIA,  Mr.  Schulte  had  moved  on  from  them. 

At  his  new  job,  he  made  $200,000  a  year,  lived  on  39th  Street 
and  was  doing  fine.  This  is  the  person  that  the  CIA  wants  you 
to  believe,  that  the  government  wants  you  to  believe,  a  man  who 
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worked  for  government  his  entire  life  and  who  dedicated  his 
time  and  his  energy  to  furthering  the  goals  of  the  United 
States,  this  is  the  man  that  they  want  you  to  believe  was  so 
upset  about  fights  at  the  CIA  that  he  would  literally  throw 
everything  under  the  bus  —  not  just  everything  in  terms  of  the 
United  States  but  everything  that  he  now  had  in  November  of 
2016  --  a  new  job,  a  new  life,  a  new  city;  he  would  throw  it 
all  under  the  bus  because  management  had  not  supported  him  over 
a  year  ago. 

Look,  they  know  that  they  have  problems  with  the 
WikiLeaks  counts,  as  the  judge  has  identified  them,  and  you 
will  see  those  problems,  and  you  will  reach  the  only  verdict 
you  can,  which  will  be  a  verdict  of  not  guilty,  which  is  why 
the  government  will  focus  a  large  part  of  its  evidence  on  what 
they  will  call  the  MCC  counts.  You  will  see  that  they  have  no 
evidence  that  Mr.  Schulte  was  ever  in  contact  with  WikiLeaks. 

You  will  see  that  they  have  no  evidence  that  WikiLeaks 
was  the  first  entity,  person,  government,  foreign  agency  to  get 
that  information.  They  will  be  able  to  give  you  no  such 
evidence,  so  they  will  shift.  And  they  will  shift  to  what  they 
call  his  quote/unquote  information  war.  They  are  going  to  try 
and  convince  you  that  Mr.  Schulte  is  that  person  because  that 
is  all  that  they  have,  and  they  will  give  you  evidence  in  the 
hope  that  it  will  make  you  think  of  Mr.  Schulte  as  a  bad 
person . 
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Now,  I've  said  this  before  and  I'll  say  it  again. 

Mr.  Schulte  is  a  difficult  man.  You  will  hear  that  after 
Mr.  Schulte  was  incarcerated  at  the  MCC,  he  was  desperate.  He 
really  was  desperate,  desperate  to  prove  that  he  was  innocent. 
He  wanted  the  world  to  know  he  wasn't  this  person,  he  was  not 
the  man  who  stole  the  information,  he  was  not  the  man  who 
released  the  information  to  WikiLeaks,  he  had  nothing  to  do 
with  that  theft. 

So  what  does  Mr.  Schulte  do? 

Mr.  Schulte  tries  to  go  around  and  show  the  world  that 
he  is  innocent.  And  yes,  he  gets  a  cell  phone,  he  keeps  a 
journal,  he  contacts  the  media  to  tell  them.  Look,  I'm  wrongly 
arrested;  I  did  not  do  this.  That  is  what  Mr.  Schulte  does 
while  sitting  in  the  MCC.  Does  that  mean  that  he  stole  the 
information  from  the  CIA?  No. 

Think  about  this.  Think  if  you  were  Mr.  Schulte, 
wrongly  accused,  if  you  were  in  his  shoes,  sitting  at  the  MCC 
day  after  day  hearing  people  say.  This  is  the  man,  this  is  the 
traitor,  this  is  the  guy  who  stole,  would  you  be  so  desperate? 
Would  you  be  so  upset?  Would  you  be  the  person  who  reaches  out 
and  says  I  did  not  do  this?  That  is  what  Mr.  Schulte  did. 

You  may  not  like  what  Mr.  Schulte  did  from  the  MCC, 
but  this  case  really  isn't  about  whether  or  not  you  like 
Mr.  Schulte.  It  really  isn't  about  whether  or  not  Mr.  Schulte 
is  a  difficult  person.  It  really  isn't  about  whether  or  not 
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Mr.  Schulte  was  liked  or  disliked.  If  you  pay  attention  to  the 
evidence,  if  you  listen  to  the  evidence  on  the  WikiLeaks 
counts,  you  will  be  no  different  than  me.  You  will  see  that 
the  evidence  simply  does  not  show  that  Mr.  Schulte  had  anything 
to  do  with  taking  the  information  from  the  CIA  and  releasing  it 
to  WikiLeaks . 

The  CIA  still  does  not  know,  and  as  you  hear  the 
government  put  in  evidence  after  evidence,  you  will  see  that 
they  will  never  be  able  to  tell  you  how  the  evidence  was  taken, 
whether,  in  fact,  WikiLeaks  was  the  only  entity  that  got  it. 
They  will  certainly  never  be  able  to  show  any  relationship 
between  Mr.  Schulte  and  WikiLeaks.  And  for  all  of  those 
reasons,  if  you  do  as  the  government  said  —  just  use  your 
common  sense  —  you  will  reach  the  only  verdict  that  is  proper 
in  this  case,  a  verdict  of  not  guilty. 

Thank  you  for  listening  to  me. 

THE  COURT:  Thank  you,  Ms.  Shroff. 

Call  the  first  witness. 

MR.  DENTON:  Your  Honor,  the  government  calls  Paul 
Rosenzweig . 

PAUL  ROSENZWEIG, 

called  as  a  witness  by  the  government, 
having  been  duly  sworn,  testified  as  follows: 

THE  COURT:  Please  sit  down,  Mr.  Rosenzweig.  Pull 
yourself  right  up  to  the  microphone. 
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THE  WITNESS:  Thank  you.  Can  I  get  a  glass  of  water? 
Thank  you  very  much. 

THE  COURT:  Mr.  Denton. 

DIRECT  EXAMINATION 
BY  MR.  DENTON: 

Q.  Good  morning. 

A.  Good  morning. 

Q.  Mr.  Rosenzweig,  where  do  you  work? 

A.  I  work  in  Washington,  D.C. 

Q.  And  what  do  you  do? 

A.  I  principally  have  three  jobs  right  now.  The  main  one  is 
I'm  a  principal  in  my  own  private  consultancy  and  law  firm, 
where  I  practice  national  security,  cyber-security  law  as  well 
as  some  criminal  defense  law. 

Q.  And  what  are  your  other  positions? 

A.  I'm  also  a  senior  fellow  at  the  R  Street  Institute,  which 
is  a  think  tank  in  Washington,  D.C.  We  spend  our  time  trying 
to  propose  new  policies  for  consideration  by  the  government. 

And  my  third  job  is  as  an  adjunct  professor  —  professorial 
lecturing  was  the  official  title  —  at  the  George  Washington 
University  School  of  Law. 

Q.  Is  your  current  work  in  any  particular  field  or  specialty? 
A.  About  95  percent  of  what  I  do  these  days  is  in  the  broad  -- 
broadly  defined  area  of  cyber-security  law  and  policy,  issues 
relating  to  the  security  of  systems  and  the  policy  rules 
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1  relating  to  how  we  might  better  protect  them. 

2  Q.  Could  you  tell  us  a  little  more  about  your  professional 

3  background? 

4  A.  Well,  I  graduated  law  school  in  1986,  and  after  a 

5  clerkship,  I  spent  the  first  seven  years  of  my  career  as  a 

6  prosecutor  in  the  Department  of  Justice  in  Washington,  D.C. 

7  Since  then,  I've  been  in  and  out  of  government  and  private 

8  practice,  back  and  forth.  I  did  a  stint  as  an  investigative 

9  counsel  at  a  —  with  a  committee  of  Congress  and  the  House  of 

10  Representatives.  I  was  part  of  the  independent  counsel 

11  investigation  that  looked  at  President  Bill  Clinton's  conduct. 

12  Most  recently,  in  government,  from  2005  to  2009,  I  was  a  deputy 

13  assistant  secretary  for  policy  at  the  then  brand-new  Department 

14  of  Homeland  Security. 

15  Q.  Mr.  Rosenzweig,  are  you  familiar  with  the  website 

16  WikiLeaks? 

17  A.  Yes,  I  am. 

18  Q.  How  have  you  come  to  know  about  WikiLeaks? 

19  A.  Well,  WikiLeaks  has  fed  into  my  professional  activity  and 

20  interests  in  three  sorts  of  ways. 

21  First,  because  I  study  and  work  in  the  national-security 

22  field,  I  have  been  interested  in  and  studied  WikiLeaks  because 

23  of  the  effect  that  certain  leaks  of  classified  information  on 

24  WikiLeaks  have  affected  national  security  of  the  United  States. 

25  Second,  as  a  teacher  of  cyber  security,  I've  been 
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1  interested  in  the  ways  in  which  information  has  been  passed  on 

2  to  WikiLeaks,  I  guess  is  the  best  way  to  say  it,  from  where, 

3  from  what  sources  it  came  and  how  it  gets  to  WikiLeaks  and  then 

4  what  they  do  with  it . 

5  Third,  I've  also  had  a  position  for  a  number  of  years  as  an 

6  adjunct  lecturer  at  the  Northwestern  University  School  of 

7  Journalism,  the  McGill  School  of  Journalism.  And  so,  I've  been 

8  interested  in  WikiLeaks  as  a  journalism  phenomenon  in  terms  of 

9  how  the  disclosure  of  classified  information  in  that  forum  has 

10  kind  of  changed  the  nature  of  journalism,  or  is  trying  to 

11  change  the  nature  of  journalism,  today. 

12  Q.  Have  you  done  research  on  WikiLeaks? 

13  A.  Yes,  I  have. 

14  Q.  How  do  you  conduct  research  on  WikiLeaks? 

15  A.  Well,  because  WikiLeaks  is  a  relatively  closed  organization 

16  with  only  a  few  known  public  members,  most  of  the  information 

17  that  you  study  about  WikiLeaks  to  try  and  understand  what  it's 

18  doing  and  how  it  operates  comes  from  public  sources.  The  most 

19  prominent  of  them,  of  course,  is  WikiLeaks  itself.  They 

20  operate  a  website,  WikiLeaks.org,  and  a  Twitter  that  they  said 

21  are  their  public  statement  sources,  so  anything  that's  on 

22  either  of  those  is  official.  You  can  listen  to  their  founder, 

23  Julian  Assange,  who  frequently  speaks  in  public  about  WikiLeaks 

24  and  his  intent  with  respect  to  that  organization. 

25  Then,  of  course,  there  are  lots  of  other  areas  in  which 
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1  people  have  written  about  WikiLeaks  and  analyzed  it,  ranging 

2  from  reviews  of  certain  of  their  prior  large-scale  disclosures, 

3  publications  that  are  related  to  national  security,  assessments 

4  of  what  those  mean  and  how  they've  affected  the  United  States. 

5  And  then  there's  lots  of  secondary  literature,  people  who 

6  write,  have  written,  about  what  they  think  WikiLeaks's  intent 

7  and  meaning  is  and  how  it's  going  to  do,  why  it  does  what  it 

8  does. 

9  Q.  Have  you  published  any  work  related  to  WikiLeaks? 

10  A.  I  have. 

11  Q.  Generally  speaking,  what  have  you  published? 

12  A.  Back  in  2010,  2011,  when  WikiLeaks  first  came  to 

13  prominence,  I  published  a  few  articles  about  the  application  of 

14  criminal  law  to  WikiLeaks  and  potentially  to  Julian  Assange  and 

15  how  that  might  interact  with  First  Amendment  considerations. 

16  In  2014,  along  with  two  of  my  teach  —  co-faculty  members 

17  at  the  McGill  School  of  Journalism,  I  co-edited  a  book  that  was 

18  published  by  the  McGill  School  of  Journalism  and  the  American 

19  Bar  Association,  the  title  of  which  was  Whistleblowers,  Leaks, 

20  and  the  Media,  which  was  principally  about  WikiLeaks  and  also 

21  about  Edward  Snowden  and  the  phenomenon  of  those  two  events. 

22  Q.  Have  you  conducted  additional  research  specifically  to 

23  prepare  for  testifying  in  this  case? 

24  A.  Yes,  I  have. 

25  Q.  Have  you  ever  testified  in  court  before? 
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A.  No,  I  haven't. 

Q.  Have  you  ever  testified  before  Congress? 

A.  Yes,  I  have. 

Q.  Again,  generally  speaking,  what  did  you  testify  about? 

A.  When  I  have  testified  before  Congress  in  my  personal 
capacity,  it's  almost  always  been  about  cyber  security-related 
issues.  When  I  was  a  deputy  assistant  secretary  for  policy  at 
DHS,  I  probably  testified  a  half  dozen  times,  and  there,  the 
topic  matter  ranged  across  all  of  the  issues  that  are  within 
the  Department  of  Homeland  Security's  portfolio. 

Q.  Are  you  being  paid  by  the  government  for  your  time  here 
today  and  preparing  to  testify? 

A.  Yes. 

MR.  DENTON:  Your  Honor,  the  government  offers  Paul 
Rosenzweig  as  an  expert  on  WikiLeaks. 

THE  COURT:  Ms.  Shroff. 

MS.  SHROFF:  Your  Honor,  we  object,  and  we'd  like  to 
voir  dire . 

THE  COURT:  You  can  have  a  short  voir  dire.  I've 
already  ruled  on  this,  but  go  ahead.  You  can  have  a  short  voir 
dire . 

VOIR  DIRE  EXAMINATION 
BY  MS .  SHROFF : 

Q.  Sir,  you  testified  that  you've  testified  before  Congress, 
correct? 
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1  A.  Yes. 

2  Q.  You've  never  testified  as  a  WikiLeaks  expert  before 

3  Congress,  correct? 

4  A.  No.  I  have,  however,  testified  about  whistleblowers 

5  generally,  not  about  WikiLeaks  specifically. 

6  MS.  SHROFF:  Your  Honor,  could  you  instruct  the 

7  witness  to  answer  my  question,  please. 

8  THE  COURT :  It  will  move  along  a  lot  faster  if  you 

9  listen  to  the  question  and  just  answer  it. 

10  THE  WITNESS:  Sure. 

11  BY  MS.  SHROFF: 

12  Q.  So  the  answer  is  no,  you've  never  testified  as  a  WikiLeaks 

13  expert  before  Congress? 

14  A.  No. 

15  Q.  And  you've  never  been  qualified  as  an  expert  on  WikiLeaks, 

16  correct? 

17  A.  No. 

18  Q.  And  in  fact,  you  know  no  one  in  WikiLeaks,  correct? 

19  A.  I  don't  know. 

20  Q.  And  you've  never  talked  to  Mr.  Assange,  correct? 

21  A.  No. 

22  Q.  And  you've  never  talked  to  anybody  who  represents 

23  Mr.  Assange,  correct? 

24  A.  That's  wrong. 

25  Q.  OK.  Who  have  you  talked  to  that  represents  Mr.  Assange? 
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1 

A.  I  believe  I've  spoken  with  Mr.  Ratner  on  a  couple  of 

2 

occasions  in  the  past. 

3 

Q.  You  mean  his  lawyer? 

4 

A.  Yeah. 

5 

Q.  OK.  But  certainly  you're  not  suggesting  to  this  jury  that 

6 

a  lawyer  would  divulge  any  private  information  about 

7 

Mr.  Assange  to  you,  correct? 

8 

A.  No,  I  didn't  say  that. 

9 

Q.  Right.  So  you've  never  had  —  I'll  leave  it  alone. 

10 

Dr.  Rosenzweig,  is  it  fair  to  say  that  all  of  your 

11 

knowledge  about  WikiLeaks  is  derivative  of  public  sources? 

12 

A.  Yes,  I  think  that  is. 

13 

Q.  Right.  So  you  read  what  somebody  else  has  written  about 

14 

WikiLeaks,  churn  it  in  your  head  and  write  about  it,  correct? 

15 

A.  Analyze  it,  yes.  Yeah. 

16 

Q.  Same  thing.  But  that's  it,  right? 

17 

A.  Correct. 

18 

MS.  SHROFF:  Your  Honor,  we  object  to  Mr.  Rosenzweig. 

19 

He  has  no  — 

20 

THE  COURT:  The  objection's  overruled. 

21 

MS .  SHROFF :  OK . 

22 

MR.  DENTON:  Your  Honor,  may  I  approach? 

23 

THE  COURT:  Yes,  you  may. 

24 

BY  MR.  DENTON: 

25 

Q.  Mr.  Rosenzweig,  I've  handed  you  what's  been  marked  for 

SOUTHERN  DISTRICT  REPORTERS,  P.C. 
(212)  805-0300 


44 

K24Wsch2  Rosenzweig  -  Direct 

1 

identification  as  Government  Exhibit  1702.  Do  you  recognize 

2 

that? 

3 

A.  Yes,  I  do.  I  prepared  it. 

4 

Q.  What  is  it? 

5 

A.  It ' s  a  summary  demonstrative  exhibit  that  contains 

6 

information  and  pictures  that  will  help  me  explain  what  I  know 

7 

about  WikiLeaks . 

8 

Q.  Did  you  have  help  in  preparing  it? 

9 

A.  I  did. 

10 

MR.  DENTON:  Your  Honor,  the  government  offers 

11 

Government  Exhibit  1702  as  a  demonstrative. 

12 

MS.  SHROFF:  We  object,  your  Honor. 

13 

THE  COURT:  Overruled. 

14 

MR.  DENTON:  May  we  publish  it  to  the  jury,  your 

15 

Honor? 

16 

THE  COURT:  Yes,  you  may. 

17 

BY  MR.  DENTON: 

18 

Q.  Mr.  Rosenzweig,  at  a  very  high  level,  what  is  WikiLeaks? 

19 

A.  Well,  WikiLeaks  is  a  self-described  organization  dedicated 

20 

to  the  publication  and  disclosure  of  confidential,  classified 

21 

information.  It's  been  described  by  Julian  Assange  as 

22 

uncensorable,  untraceable,  as  a  source  of  mass  data  sets. 

23 

Q.  How  does  WikiLeaks  disseminate  its  information? 

24 

A.  Well,  the  principal  method  that  it  uses  is  a  website. 

25 

WikiLeaks.org. 
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Q.  What  are  we  looking  at  on  the  screen  here? 

A.  This  is  a  screenshot  of  the  front  page  of  WikiLeaks.org  as 
it  appears  today. 

Q.  You  said  a  moment  ago  that  WikiLeaks  publishes  classified 
information.  What  is  classified  information? 

MS.  SHROFF:  Objection. 

THE  COURT:  Overruled. 

A.  Classified  information  is  information  that  the  United 
States  government  has  classified  because  its  disclosure  would 
cause  some  form  of  harm  to  the  national  security  interests  of 
the  United  States. 

Q.  I  want  to  talk  a  little  bit  about  the  background  on 
WikiLeaks . 

MR.  DENTON:  Ms.  Hurst,  if  we  could  go  to  the  next 
page,  please. 

Q.  When  was  WikiLeaks  founded? 

A.  WikiLeaks  was  founded  in  2006  by  Julian  Assange. 

Q.  Who  is  Julian  Assange? 

A.  Julian  Assange  is  an  Australian,  a  self-described 
transparency  advocate,  who  founded  WikiLeaks  for  the  public  — 
for  the  purpose  of  providing  a  forum  for  the  disclosure  of 
information  he  thought  the  public  needed  to  know. 

Q.  When  did  WikiLeaks  first  post  material? 

A.  Its  first  known  public  disclosure  was  in  December  of  20  — 
of  2006,  when  it  disclosed  information  relating  to  Sheikh  All's 
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1  decision  or  order  to  execute  certain  Somali  government 

2  officials. 

3  Q.  Now,  Mr.  Rosenzweig,  just  looking  at  the  screen  here,  in 

4  the  corner  there's  an  image  and  then  text  that  says  WikiLeaks. 

5  Do  you  see  that? 

6  A.  Yes. 

7  Q.  What  is  that? 

8  A.  That's  their  symbol,  but  we  put  it  on  there  just  to 

9  identify  this  as  relating  to  WikiLeaks. 

10  Q.  Just  to  be  clear,  WikiLeaks  did  not  prepare  this  — 

11  A.  Oh,  absolutely  not.  I  prepared  this. 

12  Q.  After  the  first  disclosure,  in  2006,  how  would  you 

13  characterize  the  volume  of  material  posted  by  WikiLeaks? 

14  A.  Well,  from  2006  until  today,  they  have  disclosed  tens  of 

15  millions  of  pages  of  information  of  various  sorts  and  types. 

16  It's  impossible  to  get  a  precise  number,  but  in  the  tens  of 

17  millions,  for  sure. 

18  Q.  Based  on  your  research,  are  there  particular  groups  of 

19  WikiLeaks  disclosures  that  you  consider  especially  notable? 

20  A.  There  are  certainly  some  that  are  especially  notable  in  the 

21  context  of  American  national  security,  yes. 

22  Q.  Why  are  they  notable? 

23  A.  In  part,  because  of  their  volume;  in  part,  because  of  their 

24  large-scale  effect  on  American  national  security  and  politics; 

25  in  part,  because  of  the  sensitivity  of  some  of  the  things 
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they've  disclosed. 

Q.  Let's  talk  about  some  of  those. 

MR.  DENTON:  If  we  could  go  to  the  next  page,  please. 
Q.  Let's  start  at  the  top  here,  April  5,  2010.  What  did 
WikiLeaks  post  then? 

A.  On  April  5,  2010,  WikiLeaks  disclosed  a  video  that  had  been 
sourced  to  the  American  military  in  Iraq,  a  U.S.  helicopter. 
What  the  video  disclosed  was,  as  the  title  that  WikiLeaks  gave 
it,  collateral  murder,  suggests,  the  accidental  killing  of  a 
number  of  Iraqi  civilians  as  well  as,  it  turns  out  later,  two 
journalists  from  Reuters  who  were  also  killed  in  the  attack. 

Q.  And  then  next,  July  and  October  of  2010,  what  was  that? 

A.  In  July  and  October  2010,  WikiLeaks  published  two  groups  of 
documents  known  respectively  as  the  Afghanistan  and  Iraq  war 
logs.  There  were,  in  total,  about  450,000  of  them,  and  these 
were  essentially  internal  U.S.  military  logs  and  reports  of 
activity  during  the  war  in  Iraq,  everything  ranging  from 
reports  on  patrols  to  reports  on  casualties  to  discussions  with 
Iraqis  about  assistance  to  the  United  States  government. 
Basically,  the  sum  and  substance  of  a  lot  of  tactical-level 
military  activity  on  the  ground. 

Q.  Now,  I  want  to  ask  you  about  the  other  ones  on  this  page  in 
a  little  more  detail.  Looking  at  November  28,  2018,  which 
you've  labeled  Cablegate,  what  was  Cablegate? 

A.  2010,  Cablegate. 
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Q.  Sorry. 

A.  That  was  the  disclosure  of  approximately  a  quarter  million, 
250,000,  cables  from  the  United  States  State  Department.  The 
United  States  —  a  cable  is  really  just  a  message,  an  email. 
They  call  them  cables  because  back  in  the  old  days  they  sent 
them  by  trans-Atlantic  cable,  but  it's  essentially  a  message 
from,  say,  the  U.S.  embassy  in  Germany  to  the  secretary  of 
state  saying,  I  just  met  with  the  minister  of  interior,  and 
this  is  what  he  said.  It's  a  report  of  that  sort  of 
transaction . 

Q.  Where  did  the  name  Cablegate  come  from? 

A.  WikiLeaks  gave  the  release  that  name. 

Q.  Where  did  the  materials  that  were  posted  as  part  of 
Cablegate  come  from? 

A.  They  came  from  a  U.S.  Army  private,  who  at  the  time  was 
known  as  Bradley  Manning  and  is  today  known  as  Chelsea  Manning. 
Q.  How  do  you  know  that? 

A.  Ms.  Manning  admitted  it. 

Q.  Did  WikiLeaks's  posting  of  these  cables  have  an  effect  on 
the  United  States? 

A.  It  did. 

Q.  What  effect  did  it  have? 

MS.  SHROFF:  Objection. 

THE  COURT:  Overruled. 

A.  Well,  at  the  highest  level,  disclosure  of  confidential 
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communications  within  the  State  Department  makes  people  less 
willing  to  trust  us,  less  willing  to  talk  candidly  to  the 
Department  of  State,  since  they  don't  know  whether  or  not  what 
they  are  telling  us  in  confidence  is  going  to  be  held  in 
confidence  by  the  government,  or  can  be  held  in  confidence  by 
the  government . 

More  particularly,  specific  releases  of  information  could 
have  individualized  effect  on  the  people  mentioned  in  the 
cables,  their  —  and  their  relationships  with  other  people,  who 
would  then  know  about  their  discussions  with  the  United  States. 

MR.  DENTON:  Ms.  Hurst,  can  I  ask  you  to  go  to  the 
next  page,  please. 

Q.  Have  you  identified  a  couple  of  particular  examples  of  some 
of  the  consequences  you've  described? 

A.  Yeah.  Simply  as  a  way  of  picking  out  a  couple  that  are 
pretty  famous  and  well-known  to  describe  how  these  leaks  had 
adverse  consequences,  I  picked  two  out. 

The  first  is  an  effect  that  was  had  on  our  relationships 
with  Mexico.  The  U.S.  ambassador  to  Mexico,  a  man  named  Carlos 
Pascual,  had  sent  back  to  the  State  Department  a  fairly 
critical  cable  that  suggested  that  there  were  very  serious 
weaknesses  in  the  Mexican  government;  that  we  couldn't  rely 
upon  them,  that  sort  of  thing,  exactly  the  sort  of  candid 
information  you  would  want  an  ambassador  to  convey. 

When  that  cable  became  public,  the  Mexican  government  was 
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upset.  The  Mexican  president,  Felipe  Calderon,  said  that  there 
was  severe  damage  to  the  relationship,  and  in  the  end,  the  U.S. 
was  obliged  to  re-call  the  ambassador  to  Mexico  and  replace  him 
with  another  in  order  to  try  and  repair  the  relationship  with 
Mexico . 

Q.  Is  re-calling  an  ambassador  a  significant  event? 

MS.  SHROFF:  Objection. 

THE  COURT:  Overruled. 

A.  It  is  generally  considered  the  most  serious  sort  of 
diplomatic  event  that  can  happen  between  two  nations. 

Q.  And  then  you've  got  another  example  here.  Can  you  tell  us 
about  that,  please? 

A.  Yes.  Helmut  Metzner  was  a  member  of  the  German  FDP;  that's 
the  Free  Democratic  Party.  Germany  has  a  parliamentary 
government.  The  FDP  is,  was  at  the  time  the  third  or  fourth 
largest,  and  so  when  Germany  —  when  one  party  doesn't  get  a 
majority  in  a  parliamentary  government,  they  have  to  negotiate 
a  coalition  with  one  of  the  smaller  party  members. 

Mr.  Metzner  was  with  the  FDP,  and  he  was  providing  the  U.S. 
embassy  in  Berlin  with  some  insight  into  the  ongoing 
negotiations  in  the  forming  of  a  government  in  Germany  at  the 
time.  When  his  work  with  the  U.S.  government,  his  candor  with 
the  U.S.  government  was  disclosed,  he  was  fired  from  the  FDP; 
he'd  been  a  rising  star.  He  lost  his  job.  And  the  FDP, 
likewise,  had  said  that  it  had  significant  difficulties  and 
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1  challenges  working  with  the  then  U.S.  ambassador.  Ambassador 

2  Murphy.  And  so  there  was  a  significant  effect  on  our  ability 

3  to  work  with  that  particular  party  especially. 

4  Q.  I  want  to  talk  about  another  WikiLeaks  post  you've 

5  identified  before,  but  first,  just  as  a  matter  of  background, 

6  are  you  familiar  with  the  group  Anonymous? 

7  A .  I  am . 

8  Q.  What  is  Anonymous? 

9  A.  Anonymous  is  a  decentralized,  amorphous  group  of  what  — 

10  self-described  hacktivists  —  that's  two  words,  "hackers"  and 

11  "activists, "  together  —  who  say  that  they  do  hacking  for 

12  political  purposes,  to  make  a  political  point.  Their  very 

13  first  attack,  hacking  attack  was  on  the  Church  of  Scientology, 

14  for  example,  because  of  its  practices. 

15  Q.  Has  Anonymous  worked  with  WikiLeaks  before? 

16  A.  It  has. 

17  Q.  How  do  you  know  that? 

18  A.  Well,  again,  some  Anonymous  members  have  admitted  so  and 

19  have  said  so  publicly. 

20  Q.  Let's  start  with  2010.  What  happened  between  WikiLeaks  and 

21  Anonymous  in  2010? 

22  A.  Well,  as  we  —  there  are  three  parts  to  that,  I  think.  The 

23  first  part  we've  sort  of  already  described.  In  2010,  WikiLeaks 

24  became  quite  famous  through  a  number  of  disclosures  of  public 

25  information  about  the  United  States  and  really  rose  to 
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prominence  from  its  early  beginnings.  That,  naturally. 

2 

generated  a  lot  of  attention,  some  of  it  positive  and  some  of 

3 

it  negative.  A  lot  of  American  citizens  didn't  feel  that 

4 

WikiLeaks  had  American  —  America's  best  interests  at  heart. 

5 

One  of  the  effects  of  that,  the  second  part  of  this,  is 

6 

that  at  the  time,  in  2010,  WikiLeaks  was  using  companies  for 

7 

its  services.  It  used  PayPal  and  it  used  Amazon  and  it  used 

8 

MasterCard;  PayPal  and  MasterCard  to  get  donations,  Amazon  for 

9 

web  services,  that  sort  of  thing.  Because  of  the  adverse 

10 

reaction  to  WikiLeaks  in  the  American  public,  Amazon, 

11 

MasterCard  and  PayPal  all  suspended  their  services  to 

12 

WikiLeaks,  pulled  their  services.  PayPal  wouldn't  process 

13 

payments . 

14 

MS.  SHROFF:  Your  Honor,  we  have  an  objection. 

15 

THE  COURT:  What's  the  objection? 

16 

MS.  SHROFF:  Well,  first  of  all,  your  Honor,  we  ask 

17 

for  a  limiting  instruction  on  these  statements  not  being 

18 

admitted  for  the  truth  of  the  statements  themselves. 

19 

Secondly,  I  think  that  the  testimony  being  elicited  is 

20 

far  beyond  any  expertise  the  witness  has. 

21 

THE  COURT:  I'll  grant  the  instruction.  Much  of  your 

22 

objection  deals  with  the  offering  of  statements  to  prove  the 

23 

truth.  It's  not  offered  for  that  purpose  but  only  to  establish 

24 

that  WikiLeaks  made  these  statements,  when  they  did  so  and  how 

25 

the  classified  information  was  published.  That's  the  limiting 
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1  instruction  I'll  provide. 

2  After  that,  your  objection  is  overruled. 

3  Go  ahead,  Mr.  Denton. 

4  THE  WITNESS:  So,  the  third  part  of  this  story  is 

5  where  Anonymous  and  WikiLeaks  come  together. 

6  After  the  companies  had  stopped  serving  WikiLeaks 

7  because  of  —  because  of  their  activity.  Anonymous,  this  group 

8  of  hacktivists,  announced  an  operation.  They  called  it 

9  Operation  Payback  or  also  sometimes  known  as  Operation  Avenge 

10  Assange,  in  which  the  hacktivists  launched  cyber  attacks 

11  against  MasterCard,  PayPal,  and  —  and  they  announced  one  at 

12  Amazon,  but  then  they  didn't  carry  it  out.  The  attacks  were 

13  generally  not  successful,  but  they  were  part  of  a  process  by 

14  which  Anonymous  offered  support  for  WikiLeaks. 

15  Q.  And  again,  how  do  you  know  that? 

16  A.  Again,  it's  a  matter  of  public  record.  The  —  14  of  the 

17  participants  in  Operation  Payback  have  admitted  to  the 

18  substance  of  what  I've  just  described. 

19  Q.  Has  Anonymous  ever  served  as  a  source  of  information  for 

20  WikiLeaks? 

21  A.  Yes,  it  has. 

22  In  2012,  a  WikiLeak  —  an  Anonymous  hacktivist  named  Jeremy 

23  Hammond  stole  a  series  of  emails  from  a  private  intelligence 

24  research  company  called  Stratfor.  Stratfor  basically  provides 

25  companies  with  the  same  type  of  intelligence  gathering  and 


SOUTHERN  DISTRICT  REPORTERS,  P.C. 
(212)  805-0300 


54 

K24Wsch2  Rosenzweig  -  Direct 

1  collection  that  they  think  national-security  people  provide. 

2  They  tell  them  what's  coming,  who  is  going  to  win  elections, 

3  that  sort  of  thing.  Hammond  stole  these  emails  and  provided 

4  them  to  WikiLeaks,  which  then  published  them. 

5  Q.  And  again,  how  do  you  know  that? 

6  A.  Hammond  has  admitted  to  that. 

7  Q.  So  then  let's  move  to  a  little  more  recently,  if  we  can. 

8  Was  WikiLeaks  doing  anything  in  the  summer  and  fall  of  2016? 

9  A.  WikiLeaks  was  involved  in  two  instances  of  publication  of 

10  information  that  were  related  to  the  2016  national  election. 

11  Q.  Was  there  substantial  press  coverage  of  these  leaks? 

12  MS.  SHROFF:  Objection. 

13  THE  COURT:  Overruled. 

14  A.  Yes. 

15  Q.  Starting  with  the  top,  what  came  first? 

16  A.  Well,  the  first  such  release  of  information  came  from  data 

17  that  had  been  stolen  from  the  Democratic  National  Committee, 

18  the  committee  that  runs  the  democratic  party  and  that  runs  the 

19  nomination  process  for  candidates  of  the  democratic  party. 

20  The  —  19,000-plus  emails  were  released  in  July,  just  on  the 

21  eve  of  the  national  convention,  and  another  8,000  were  released 

22  on  November  6,  just  on  the  eve  of  the  national  election. 

23  Q.  And  what  next,  down  below  that? 

24  A.  John  Podesta  was  the  chairman  or  manager  of  Hillary 

25  Clinton's  election  campaign.  He,  too,  was  hacked,  and  over 
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1  200,000  pages  of  his  files,  all  relating  to  the  campaign,  were 

2  subsequently  published  by  WikiLeaks,  almost  daily,  beginning  in 

3  October  and  running  right  up  to  the  Election  Day  in  early 

4  November  of  2016. 

5  Q.  I  think  you've  highlighted  a  couple  of  dates,  but  as  a 

6  general  matter,  did  these  leaks  happen  over  time? 

7  A.  Yes.  The  —  certainly  the  ones  with  respect  to  Mr.  Podesta 

8  happened  essentially  daily  over  that  time  frame. 

9  Q.  Mr.  Rosenzweig,  what  do  you  know  about  how  those  emails 

10  were  provided  to  WikiLeaks? 

11  A.  I  have  reviewed  public  reports  about  those  from 

12  private-sector  cyber  security  firms.  I  have  reviewed  reports 

13  from  the  Senate  intelligence  committee.  I've  reviewed  reports, 

14  insofar  as  they're  public,  from  the  intelligence  community  and 

15  FROM  the  special  counsel  who  investigated  these  matters.  And 

16  so,  on  that  basis,  I  —  I  guess  the  question  was  what  do  I 

17  know? 

18  I  know  that  all  of  these  are  in  — 

19  MS.  SHROFF:  Your  Honor,  we  have  an  objection  based  on 

20  hearsay. 

21  THE  COURT:  Overruled. 

22  A.  All  of  these  are  of  the  view  that  the  information  was 

23  stolen  from  both  the  DNC  and  the  Clinton  campaign  by  elements 

24  of  the  Russian  government  and  passed  to  WikiLeaks  through 

25  various  sources,  notably  one  called  Guccifer  2.0,  which  is  a 
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hacker  name  for  what  appears  to  be  a  fictitious,  nonexistent 
person . 

Q.  Does  WikiLeaks  provide  any  guidance  on  how  people  in 
possession  of  sensitive  information  can  get  it  to  WikiLeaks? 

A.  Yeah,  they  have  a  whole  page  on  how  to  do  that. 

MR.  DENTON:  Let's  take  a  look  at  that,  Ms.  Hurst, 

please . 

Q.  Mr.  Rosenzweig,  where  does  this  page  come  from? 

A.  This  is  a  screenshot  from  the  "submit  documents  to 
WikiLeaks"  web  page  as  it  appears  today. 

Q.  Were  you  able  to  determine  whether  this  page  has  changed 
over  time? 

A.  I  was. 

Q.  How  were  you  able  to  do  that? 

A.  Well,  as  you  know,  the  internet  —  web  pages  on  the 
internet  change  daily  sometimes,  and  so,  there  is  a  function, 
an  archive  organization  that  takes  old  screenshots  —  or  takes 
screenshots  of  web  pages  periodically  and  keeps  them  in  an 
archive.  It  goes  by  the  name  of  the  Wayback  Machine  so  that 
you  can  search  in  the  archive  and  ask  it  whether  or  not  it  has 
a  snapshot  of,  say,  how  the  U.S.  Attorney's  Office's  web  page 
looked  in  2012  or  how  my  personal  website  looks  in  2015. 

MR.  DENTON:  We  can  go  to  the  next  page,  Ms.  Hurst. 

Q.  Mr.  Rosenzweig,  what  are  we  looking  at  here? 

A.  This  is  the  Wayback  Machine-archived  picture  of  the 
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1  WikiLeaks.org  "submit  documents  to  WikiLeaks"  page  in  April  of 

2  2016. 

3  Q.  How  has  it  changed  from  April  of  2016  to  today? 

4  A.  Well,  insofar  as  I  can  tell,  the  only  difference  is  that 

5  the  website  address  that  you  are  asked  to  use  to  submit  a  leak 

6  to  WikiLeaks  through  has  changed. 

7  Q.  Is  that  a  normal  website  address? 

8  MS.  SHROFF:  Objection. 

9  THE  COURT:  Overruled. 

10  A.  It's  different  from  the  ones  that  most  people  commonly  see. 

11  It  is  what's  known  as  a  dot-onion  address. 

12  Q.  What  is  a  dot-onion  address? 

13  A.  Well,  it's  a  reference  to  a  type  of  web  browser  called  TOR, 

14  which  stands  for  The  Onion  Router.  A  dot-onion  address  is  one 

15  that  is  anonymized  and,  therefore,  difficult,  if  not 

16  impossible,  to  trace  connections  to. 

17  Q.  Generally  speaking,  looking  at  this  page,  how  does 

18  WikiLeaks  tell  people  to  submit  information  to  it? 

19  A.  Well,  they  tell  people  to  use  this  browser,  TOR,  The  Onion 

20  Router,  which  —  it  looks  just  like  any  other  browser,  like 

21  your  Safari  browser  or  your  Firefox  browser  or  something  like 

22  that,  but  it  has  this  anonymizing  function  built  into  it.  So 

23  it  tells  people  to  first  install  TOR,  The  Onion  Router,  browser 

24  on  their  computer,  and  then  use  this  address,  copy  it  into  the 

25  TOR  browser  in  order  to  access  the  secure,  untraceable  upload 
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1  site. 

2  Q.  Mr.  Rosenzweig,  do  you  see  these  boxes  down  at  the  bottom 

3  about  how  to  contact  WikiLeaks  and  what  is  TOR,  and  so  on? 

4  A.  Yeah,  I  do. 

5  Q.  What  are  those? 

6  A.  Those  are  click  —  boxes  where  you  click  on  them  and  it 

7  answers  the  question. 

8  Q.  Let's  take  a  look  at  some  of  those. 

9  MR.  DENTON:  Ms.  Hurst,  let's  go  to  the  next  page. 

10  Q.  What  does  WikiLeaks  say  about  TOR? 

11  A.  Well,  it  describes  it,  as  I  just  described  it,  as  an 

12  encrypted  anonymizing  network  that  makes  it  hard  to  intercept 

13  internet  communications.  Today,  if  you  go  to  a  web  page,  as 

14  you  probably  know,  people  track  you.  You  get  cookies,  and  they 

15  can  track  you,  and  that's  how  Google  sells  you  ads,  for 

16  example.  TOR  eliminates  that  possibility,  to  the  maximum 

17  extent  possible,  and  attempts  to  make  it  difficult  to  trace 

18  who's  accessing  a  website  so  that  you  can  do  so  in  an  anonymous 

19  way. 

20  Q.  How  does  TOR  do  that? 

21  A.  This  is  a  graphic  that  was  put  together  by  the  Electronic 

22  Erontier  Foundation,  which  is  a  pro-privacy  organization  that 

23  advocates  for  all  citizens  to  use  TOR. 

24  What  it  does,  what  TOR  does  is  essentially  create  a  random 

25  network  for  each  transmission  to  bounce  your  information  from 
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1  your  computer  to  the  web  —  to  the  server  that's  hosting  the 

2  website  that  you  want  to  go  to.  It  does  so  in  an  encrypted 

3  form  so  each  of  the  steps  is  encrypted,  and  it  goes  through  a 

4  series  of  hops  that  make  it  difficult,  along  with  the 

5  encryption,  to  bait  —  backward  trace  it.  So  in  this  diagram, 

6  Bob,  the  ultimate  recipient  of  the  information  from  Alice, 

7  could  not  know  that  it  was  Alice  who  was  sending  him  the 

8  information. 

9  MR.  DENTON:  If  we  can  go  to  the  next  page,  I  want  to 

10  look  at  the  other  thing  that  WikiLeaks  talked  about. 

11  Q.  What  is  Tails? 

12  A.  Well,  Tails  is  a  —  when  you  boot  up  your  computer,  it  runs 

13  an  operating  system  inside  your  laptop  that  starts  it.  If 

14  you're  a  Microsoft  person,  it's  Windows.  If  you're  an  Apple 

15  person,  it's  the  macOS . 

16  Tails  is  an  operating  system  that  resides  in  a  thumb  drive, 

17  and  when  you  boot  up  your  computer  with  Tails  in  the  —  stuck 

18  in  the  USB  port,  instead  of  running  your  Microsoft  Windows  or 

19  your  Apple  OS,  it  will  run  the  operating  system  from  your  thumb 

20  drive. 

21  The  reason  people  use  Tails  is  that  even  if  you  use  the 

22  anonymizing  connection  of  TOR,  you  can  still  leave  evidence  of 

23  your  communication  on  your  personal  laptop.  If  I  type  in 

24  something  on  my  keyboard  today,  it  will  —  it  could  reside  in 

25  some  forms  of  memory  for  quite  some  time.  If  I  use  Tails 
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1  instead,  if  I  run  the  operating  system  just  from  the  thumb 

2  drive  instead  of  from  what's  in  my  laptop,  then  there  is  no 

3  memory,  or  there's  much  less  memory,  of  what  happened  on  my 

4  laptop  in  the  laptop  itself.  And  so  it's  another  way  of 

5  creating  anonymity,  by  removing  the  evidence  from  my  laptop  in 

6  the  same  way  that  TOR  eliminates  it  from  my  transmission  across 

7  the  network. 

8  Q.  Just  for  the  record,  can  you  read  what  WikiLeaks  says  about 

9  Tails? 

10  A.  Sure.  It  says,  "If  you  are  at  high  risk  and  you  have  the 

11  capacity  to  do  so,  you  can  also  access  the  submission  system 

12  through  a  secure  operating  system  called  Tails.  Tails  is  an 

13  operating  system  launched  from  a  UBS  stick  or  a  DVD  that  aims 

14  to  leave  no  traces  when  the  computer  is  shut  down  after  use  and 

15  automatically  routes  your  internet  traffic  from  TOR.  Tails 

16  will  require  you  to  have  either  a  USB  stick  or  a  DVD  and  at 

17  least  4GB"  —  that's  gigabytes  —  "big  and  a  laptop  or  desktop 

18  computer." 

19  MR.  DENTON:  If  we  can  go  to  the  next  page. 

20  Q.  Does  Tails  stand  for  anything? 

21  A.  Oh,  sorry. 

22  Yes,  it  stands  for  The  Amnesic  Incognito  Live  System. 

23  That's  because  it  forgets  what  it  is.  There's  no  memory  of 

24  what  it  does,  and  it  allows  you  to  act  incognito,  anonymously. 

25  Q.  What  is  this  page  here  that  we're  looking  at? 
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A.  This  is  the  download  page  from  which  you  can  download  the 
latest  version  of  Tails. 

Q.  And  where  it  says  Tails  2.2.1,  what  does  that  mean? 

A.  That's  a  version  control,  like,  like  Tails  2.1,  Tails  2.2, 
Tails  —  it's  just  the  most  recent  revision  or  release  of  the 
system. 

Q.  And  what's  the  date  for  that  revision? 

A.  That  revision  is  March  18,  2016.  So  that's  the  date  of 
that  particular  version  of  Tails. 

MR.  DENTON:  If  we  could  go  to  the  next  page,  please, 
Ms.  Hurst. 

Q.  How  does  someone  get  Tails,  Mr.  Rosenzweig? 

A.  Pretty  much  the  same  way  that  one  gets  any  application  for 
one's  system.  You  go  to  one  of  the  download  pages.  You  click 
on  the  link  and  the  files  download  and  then  they  get  installed, 
in  this  case  on  a  USB  rather  than  on  your  computer,  but,  in 
effect,  the  operation  is  the  same. 

Q.  Do  you  see  on  the  left  where  it  says  "download  Tails 
torrent  file"? 

A.  Yes. 

Q.  Sorry.  On  the  right. 

A.  Yeah.  OK.  Thank  you. 

Yes,  I  do  see  the  torrent,  bit  torrent  download,  yes. 

Q.  What  is  a  bit  torrent  download? 

A.  Bit  torrent  is  another  way  of  downloading  information. 
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1  It's  what's  known  as  a  peer-to-peer  system,  so  instead  of 

2  downloading  from  a  server,  you  download  directly  from  another 

3  host  who  can  transmit  it  to  you  directly.  It's  just  a 

4  different  way  of  downloading,  really. 

5  MR.  DENTON:  If  we  could  go  back  to  WikiLeaks  for  a 

6  moment . 

7  Q.  Mr.  Rosenzweig,  what  are  we  looking  at  here? 

8  A.  Well,  this  is  another  pop-up  from  the  buttons  below.  This 

9  is  further  information  that  WikiLeaks  provides  to  people  who 

10  are  contemplating  sending  it  information  on  how  to  avoid  being 

11  discovered  and  preserve  their  anonymity. 

12  Q.  Can  you  read  what  WikiLeaks  says  at  the  top,  just  under 

13  tips,  generally? 

14  A.  Sure.  It  says,  I  think  accurately:  "Our  submission  system 

15  works  hard  to  preserve  your  anonymity,  but  we  recommend  you 

16  also  take  some  of  your  own  precautions.  Please  review  these 

17  basic  guidelines." 

18  Q.  Can  you  focus  on  No.  2.  What  does  it  say  under  No.  2? 

19  A.  It  recommends,  under  "what  computer  to  use, "  that  "if  the 

20  computer  you  are  uploading  from  could  subsequently  be  audited 

21  in  an  investigation,  consider  using  a  computer  that  is  not 

22  easily  tied  to  you.  Technical  users  can  also  use  Tails  to  help 

23  ensure  you  do  not  leave  any  reference  of  your  submission  on  the 

24  computer." 

25  Q.  Finally,  if  we  could  talk  about  the  last  part  of 
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1  WikiLeaks's  page  here,  what  are  we  looking  at? 

2  A.  Well,  this  is  what  to  do  afterwards.  It's  not  technical, 

3  but  it's  recommendations  on  behavior. 

4  Q.  I'm  going  to  ask  you  to  focus  on  Nos.  2  and  3. 

5  MR.  DENTON:  If  we  could  go  to  the  next,  page,  please, 

6  and  try  and  blow  those  up. 

7  Q.  Can  you  read  No.  2t  for  us? 

8  A.  Yes.  It  says:  "Act  normal.  If  you  are  a  high-risk 

9  source,  avoid  saying  anything  or  doing  anything  after 

10  submitting  which  might  promote  suspicion.  In  particular,  you 

11  should  try  to  stick  to  your  normal  routine  and  behavior." 

12  Q.  And  then  No.  3,  please. 

13  A.  "Remove  traces  of  your  submission.  If  you  are  a  high-risk 

14  source  and  the  computer  you  prepared  your  submission  on  or 

15  uploaded  it  from  could  subsequently  be  audited  in  an 

16  investigation,  we  recommend  that  you  format  and  dispose  of  the 

17  computer  hard  drive  and  any  other  storage  media  you  used.  In 

18  particular,  hard  drives  retain  data  after  formatting  which  may 

19  be  visible  to  a  digital  forensic  team.  And  flash  media  —  USB 

20  sticks,  memory  cards  and  SSD  drives  —  retain  daft  even  after  a 

21  secure  erasure.  If  you  use  flash  media  to  store  sensitive 

22  data,  it  is  important  to  destroy  the  media.  If  you  do  this  and 

23  are  a  high-risk  source,  you  should  make  sure  there  are  no 

24  traces  of  the  cleanup,  since  such  traces  themselves  may  draw 

25  suspicion . " 
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Q.  Now  I  want  to  put  aside  some  of  this  technical  stuff  for  a 
moment,  Mr.  Rosenzweig. 

MR.  DENTON:  If  we  could  go  to  the  next  page. 

Q.  Has  WikiLeaks  actively  solicited  any  particular  type  of 
information? 

A.  Yes.  They  are  —  they  have  in  the  past  actively  solicited 
the  leak  of  classified  U.S.  government  information. 

Q.  Are  there  particular  examples  of  that? 

A.  Well,  I've  noted  two,  a  couple,  here.  They  have  had,  from 
the  beginning,  a  most-wanted  list  of  leaks  that  they  would  like 
to  have.  They  have  a  crowd  —  and  they  also  have  a 
Crowdfunding  page  on  which  you  can  pledge  money  to  pay  for  the 
work  that  might  go  into  securing  a  leak. 

Q.  These  two  quotes  at  the  bottom  here,  who  said  those  things? 
A.  Both  of  them  are  from  Julian  Assange. 

Q.  I  want  to  ask  you  in  particular  about  the  bottom  one,  and 
in  particular,  I  guess  it's  the  end  of  the  second  and  most  of 
the  third  line.  It  says,  "It  is  possible  now  for  even  a  single 
system  administrator  to  have  a  very  significant  change." 


Are  you  familiar  with  the  term  " 

system  administrator"? 

A. 

Yes  . 

Q. 

Is  that  a  technical  term? 

A. 

Yes  . 

Q. 

What  does  it  mean? 

A. 

Well,  it  is,  generally  speaking. 

the  person  who  is  in 

SOUTHERN  DISTRICT  REPORTERS,  P.C. 
(212)  805-0300 


65 


1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 


K24Wsch2  Rosenzweig  -  Direct 

charge  of  a  computer  IT  system.  He's  the  person  who  you  go  to 
to  recover  your  password.  He's  the  person  that  you  go  to  to 
change  access  rules  so  that  you  can  get  access  to  different 
parts  of  the  system.  He's  the  guy  in  charge. 

Q.  Now,  based  on  your  research,  Mr.  Rosenzweig,  have  you  been 
able  to  determine  any  sort  of  patterns  or  consistent  practices 
with  respect  to  WikiLeaks's  posts  of  sensitive  information? 

A.  Yes,  I  —  I've  studied,  to  some  degree,  the  —  well,  I've 
studied  the  ways  in  which  WikiLeaks  redacts  and  does  not  redact 
information  that  it  hosts  on  the  page. 

Q.  Let's  talk  a  little  bit  about  that.  Let's  start  at  the 
top.  What  do  you  mean  by  redacting  information? 

A.  Well,  redaction  is  essentially  a  black  box  on  a  piece  of 
paper,  at  its  simplest  form,  that  deletes,  say,  personal 
information  or  the  name  of  a  person  who  sent  a  piece  of 
information.  It  is  a  restriction  on  the  data  that  you  get  that 
cuts  out  a  piece  of  it. 

Q.  And  what  have  you  been  able  to  determine  about  WikiLeaks's 
practices  with  respect  to  redactions? 

A.  Well,  they're  inconsistent.  They've  changed  over  time.  It 
started  —  WikiLeaks  started  out  with  almost  no  redaction 
practices  at  all.  They  were  actually  just  operating  a  Wiki 
that  almost  anybody  could  upload  to.  Over  time,  their 
redaction  practices  have  changed.  They've  curated  some  of 
their  releases  so  that  they  are  —  how  shall  I  say? 
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They've  curated  some  of  the  releases  so  that  they  have 
attempted  to  remove  some  personal  information  from  them,  often 
incompletely.  Sometimes  they  make  releases  and  then  they 
realize  that  they've  released  something  that,  maybe,  could  hurt 
an  individual,  and  they  apply  redactions  later.  It's  quite 
variable,  I  would  say. 

Q.  Does  WikiLeaks  generate  any  original  material? 

A.  Not  that  I  know  of. 

Q.  What  do  they  post  when  they  post  classified  information  or 
other  leaks  that  they're  disclosing? 

A.  WikiLeaks  posts  the  raw  information,  so  if  they  have  a  — 
450,000  logs,  they  post  the  logs  themselves,  the  actual  texts 
of  the  communication,  the  pictures  of  the  communique  that  were 
accompanying  it.  If  they  have  cables,  they  post  the  texts  of 
the  cables  in  their  original  form. 

Q.  Has  WikiLeaks  made  any  statements  about  whether  they  review 
all  of  that  material? 

A.  WikiLeaks  has  said  that  it  doesn't  traditionally  — 
typically  conduct  any  real  analysis.  Its  goal,  in  fact,  is  to 
let  the  people  decide,  to  provide  them  with  the  full 
information  that  they  can. 

Q.  In  connection  with  some  of  these  disclosures  we've  been 
talking  about,  has  WikiLeaks  ever  worked  with,  like.  The  New 
York  Times,  Wall  Street  Journal  — 

A.  Yes. 
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1  Q.  —  entities  like  that? 

2  A.  Yes,  they  have. 

3  Q.  Tell  us  a  little  about  that,  please. 

4  A.  Well,  at  times,  WikiLeaks  has  partnered  with  traditional 

5  media  organizations  in  order  to  provide  those  media 

6  organizations  with  advance  looks  at  the  material  that  they're 

7  going  to  release.  Those  media  organizations,  in  turn,  then 

8  publish  at  the  —  simultaneously  along  with  their  analysis  and 

9  their  own  reporting  about  the  leaks,  what  they  mean,  what  they 

10  think,  you  know,  who  it  might  have  come  from,  why  it's  coming 

11  out  now,  that  sort  of  thing. 

12  Q.  When  WikiLeaks  posts  information,  do  they  say  where  it 

13  comes  from? 

14  A.  No,  they  don't. 

15  Q.  What,  if  anything,  has  WikiLeaks  said  about  steps  they  take 

16  with  regard  to  sources  of  information? 

17  A.  In  fact,  they've  said  that  they  do  their  best  to  protect 

18  their  sources  of  information  both  through  the  anonymizing  steps 

19  that  we've  already  talked  about  and  by  giving  inaccurate, 

20  incomplete  or  incorrect  information  about  their  sources  in 

21  their  public  disclosures  as  a  way  of  obscuring  or  assisting  in 

22  obscuring  the  identity  of  their  sources.  In  short,  they've 

23  said  that  they  public  —  they've  publicly  said  that  they 

24  publish  inaccurate  information  about  their  sources  on  purpose. 

25  Q.  As  a  general  matter,  across  the  body  of  WikiLeaks 
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disclosures,  has  WikiLeaks  focused  on  any  particular  target? 

A.  Well,  it  is  statistically  true  that  the  overwhelming 
majority  of  the  information  that  they've  published  is  about  the 
United  States.  There  are  other  countries  in  a  number  —  which 
have  had  a  number  of  leaks,  but  the  overwhelming  majority  is 
American . 

Q.  Mr.  Rosenzweig,  have  you  become  familiar  with  a  WikiLeaks 
disclosure  known  as  Vault  7? 

A.  I  have. 

Q.  When  did  WikiLeaks  first  mention  Vault  7? 

A.  February  of  2017,  February  4,  to  be  particular. 

Q.  And  what  are  we  looking  at  here,  Mr.  Rosenzweig? 

A.  Well,  as  we  said  at  the  beginning,  WikiLeaks  has  two 
sources  of  putting  information  out.  One  is  its  web  page  that 
we've  been  focusing  on.  The  other's  its  Twitter  account. 

This  is  a  screenshot  of  the  February  4,  2017,  Twitter  feed 
from  WikiLeaks. 

Q.  Did  WikiLeaks  release  any  material  at  the  same  time  as  this 
tweet? 

A.  No.  This  was  a  teaser  tweet. 

Q.  And  there  is  a  question  here,  "What  is  Vault  7?"  Did 
WikiLeaks  answer  that  question? 

A.  Not  at  this  time,  no. 

Q.  You  called  this  a  teaser.  Did  those  teasers  continue? 

A.  Yes,  they  did,  for  a  number  of  days. 
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1 

MR.  DENTON:  Let's  take  a  look  at  those,  if  we  could. 

2 

Ms.  Hurst. 

3 

Q.  What  came  next? 

4 

A.  Well,  this  is  the  next  day:  "Where  is  Vault  7?"  With  a 

5 

kind  of  spooky  picture. 

6 

Q.  And  again,  where  do  these  pictures  come  from? 

7 

A.  I  don't  know. 

8 

Q.  Who  posted  those  — 

9 

A.  Oh,  I'm  sorry.  WikiLeaks.  WikiLeaks  posted  them.  I  don't 

10 

know  what  the  source,  original  source  of  this  is. 

11 

Q.  What  next? 

12 

A.  "When  is  Vault  7?"  That  was  the  next  day,  February  6. 

13 

Q.  And  if  we  could  keep  going,  please. 

14 

A.  "Who  is  Vault  7?"  And  this  is,  again,  a  picture  of  — 

15 

that's  Mr.  Assange  in  the  middle. 

16 

Q.  Again,  who  posted  that  particular  picture? 

17 

A.  WikiLeaks  posted  it  on  February  7,  2017. 

18 

Q.  If  we  could  go  to  the  next  one,  please? 

19 

A.  This  is  the  WikiLeaks  post  from  February  8,  "Why  is  Vault 

20 

7?  " 

21 

Q.  And  one  more,  please. 

22 

A.  And  this  is  the  February  9  post:  "How  did  Vault  7  make  its 

23 

way  to  WikiLeaks?" 

24 

Q.  Again,  we've  been  talking  about  a  lot  of  questions.  When 

25 

WikiLeaks  posted  these  tweets,  did  it  provide  answers  to  these 
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1 

questions  ? 

2 

A.  It  did  not. 

3 

MR.  DENTON:  Then  one  more,  please. 

4 

Q.  When  did  WikiLeaks  first  release  substantive  material 

5 

related  to  Vault  7? 

6 

A.  That  would  be  this,  this  picture  here,  on  March  7,  2017, 

7 

"The  release  of  Vault  7,  part  1,  year  zero,  inside  the  CIA's 

8 

global  hacking  force." 

9 

Q.  And  then  down  below  that,  do  you  see  where  it  says  "CIA 

10 

Vault  7  year  zero  decryption  pass  phrase"? 

11 

A.  Yes. 

12 

Q.  What  is  the  pass  phrase? 

13 

A.  Well,  the  pass  phrase  is  the  decryption  phrase  that  you 

14 

have  to  type  in  to  unencrypt  the  release,  and  the  phrase  they 

15 

used  is  "splinter  it  into  a  thousand  pieces  and  scatter  it  into 

16 

the  winds . " 

17 

Q.  Do  you  recognize  that  phrase? 

18 

A.  Yes. 

19 

Q.  Where  does  it  come  from? 

20 

A.  It's  attributed  to  JFK,  John  Kennedy,  who  said  it  after  the 

21 

Bay  of  Pigs  failure  in  Cuba  when  he  said  that  he  was  —  he  said 

22 

that  he  was  so  angry  at  the  CIA  that  he  was  going  to  splinter 

23 

it  into  a  thousand  pieces  and  scatter  it  into  the  wind. 

24 

Q.  Was  there  more  than  one  disclosure  tied  to  Vault  7  by 

25 

WikiLeaks  ? 
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1 

A.  Yes,  there  was. 

2 

Q.  Now,  in  terms  of  your  testimony  today,  Mr.  Rosenzweig,  did 

3 

you  review  any  of  the  actual  material  released  by  WikiLeaks 

4 

under  Vault  7? 

5 

A.  No,  I  did  not. 

6 

Q.  Why  not? 

7 

A.  Well,  two  reasons.  First,  that  wasn't  my  area  of 

8 

expertise.  And  the  second  is  that  I  continued  to  have  an 

9 

inactive  security  clearance,  and  my  understanding  is  it's  not 

10 

appropriate  for  me  to  look  at  things  I'm  not  cleared  to  know 

11 

about . 

12 

Q.  What  material  related  to  Vault  7  did  you  review? 

13 

A.  I  reviewed  the  WikiLeaks  posts  that  released  them  and 

14 

announced  them  to  the  world. 

15 

MR.  DENTON:  Let's  take  a  look  at  those,  if  we  could. 

16 

Q.  What  did  WikiLeaks  release  from  Vault  7  in  March  of  2017? 

17 

A.  There  were  three  releases  in  March  of  2017:  The  first  one 

18 

that  we've  just  discussed,  which  was  the  very  first,  "CIA 

19 

hacking  tools  revealed"  announcement;  and  then  the  first  of  a 

20 

series  of  releases  of  particular,  I  guess,  groups  of 

21 

material  —  on  March  23,  one  known  as  Project  Dark  Matter,  and 

22 

on  March  31,  one  known  as  Marble  Framework. 

23 

Q.  If  you  could  for  a  moment,  Mr.  Rosenzweig,  could  you  just 

24 

read  what  WikiLeaks  described  the  Vault  7  release  as  on  March 

25 

7? 
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1  A.  "The  WikiLeaks  releases  Vault  7  Marble, "  which  is  — 

2  Q.  I'm  sorry.  I  meant  March  7,  on  the  left. 

3  A.  Oh,  I'm  sorry.  I  apologize.  I  probably  misheard  you. 

4  "A  series  of  leaks  on  the  U.S.  Central  Intelligence  Agency 

5  code  named  Vault  7  by  WikiLeaks.  It  is  the  largest-ever 

6  publication  of  confidential  documents  on  the  agency." 

7  Q.  I  didn't  mean  to  cut  you  off. 

8  A.  Sorry. 

9  Q.  If  we  can  go  back  to  the  Marble  Framework,  please. 

10  A.  I  misheard  you. 

11  "Today,  March  31,  WikiLeaks  released  Vault  7,  Marble,  676 

12  source  code  files  with  the  CIA's  secret,  antiforensic  Marble 

13  Framework." 

14  Q.  Are  you  familiar  with  the  term  "source  code"? 

15  A.  Yes. 

16  Q.  What  is  source  code? 

17  A.  Source  code  are  the  lines  of  computer  code  that  a  computer 

18  programmer  will  use  to  design,  to  create  a  program. 

19  Q.  Did  WikiLeaks  release  more  information  from  Vault  7  after 

20  March  31,  2017? 

21  A.  Yes. 

22  Q.  About  how  many  Vault  7  releases  were  there  in  total? 

23  A.  I  think  there  were  26  in  total. 

24  Q.  Let's  take  a  look  at  the  next  set  of  them.  What  did 

25  WikiLeaks  release  from  Vault  7  in  April  of  2017? 
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1  A.  Weekly.  On  April  7,  they  released  something  known  as  the 

2  Grasshopper  Framework.  On  April  14,  they  released  something 

3  known  as  HIVE.  On  April  21,  2017,  it  was  Weeping  Angel,  and  on 

4  April  28  it  was  something  called  Scribbles. 

5  Q.  What  about  in  May,  Mr.  Rosenzweig? 

6  A.  Only  three  in  May.  May  5  was  Archimedes.  May  12  was  After 

7  Midnight  along  with  one  called  Assassin  that  didn't  make  it 

8  into  the  title.  And  on  May  19,  a  project  known  as  Athena. 

9  Q.  Did  the  leaks  continue  into  June? 

10  A.  Yes.  Five  in  June.  June  1  was  Pandemic.  June  15  was 

11  Cherry  Blossom.  June  22  was  Brutal  Kangaroo.  June  28  was 

12  Elsa,  and  June  29  was  one  known  as  Outlaw  Country. 

13  Q.  If  we  could  then  talk  about  July. 

14  A.  They  —  these  are  —  they  continued  on  a  more  or  less 

15  weekly  basis.  July  6  was  Bothan  Spy  and  another  project  called 

16  Dear  Falcon.  July  13  was  High  Rise.  July  19  was  UCL/Raytheon, 

17  UCL  standing  for  Umbrage  Component  Library.  July  27  was  a 

18  project  known  as  Imperial. 

19  Q.  Now,  these  titles  that  you're  reading,  Mr.  Rosenzweig, 

20  where  do  these  titles  come  from? 

21  A.  I  don't  know.  I  assume  that  they  are  the  CIA  titles  for 

22  the  — 

23  THE  COURT:  Don't  assume. 

24  THE  WITNESS:  Huh. 

25  THE  COURT:  If  you  don't  know,  that's  the  answer. 
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THE  WITNESS:  I  don't  know. 

BY  MR.  DENTON: 

Q.  What  you're  reading  here,  where  did  that  come  from? 

A.  Oh,  I'm  sorry.  These  are  from  WikiLeaks.  They're  from 
their  Twitter  feed. 

THE  COURT:  Members  of  the  jury,  let  me  remind  you 
these  are  offered  not  for  the  truth  but  for  the  fact  that  Wiki 
made  these  statements.  Not  for  the  truth. 

MR.  DENTON:  Thank  you,  your  Honor. 

Could  we  then  talk  about  August,  Ms.  Hurst. 

Q.  What  came  in  August? 

A.  August  3  was  a  release  of  a  project  called  Dumbo.  August 
10  was  the  release  of  a  project  called  CouchPotato.  August  24 
was  the  release  of  a  project  called  Express  Lane.  And  August 
31  was  one  that  the  CIA  called  Angel  Fire. 

MR.  DENTON:  And  then  September,  Ms.  Hurst,  please. 

A.  Just  one  in  September.  Protege  was  released  on  September 
7,  2017. 

Q.  After  Vault  7,  did  WikiLeaks  release  any  more  information, 
Mr.  Rosenzweig? 

A.  There  was  another  release  that  they  called  Vault  8. 

Q.  Talk  about  that  then,  please. 

A.  This  is  the  last  in  the  series.  It  was  called  Hive,  and 
it's  the  source  code  repository.  It  was  styled  as  the  source 
code  repository  for  the  CIA  Hive  project,  and  it  was  released 
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on  November  29,  2017. 

MR.  DENTON:  If  I  could  just  have  a  moment,  your 

Honor . 

Q.  Mr.  Rosenzweig,  you  just  read  this  here  about  the  source 
code  repository.  Is  that  the  same  thing  that  we  were  talking 
about  in  connection  with  the  earlier  release? 

A.  The  word  —  yeah,  it's  —  source  code  is  the  same  thing, 
yes  . 

Q.  Based  on  your  research  on  WikiLeaks's  publications,  prior 
to  the  Vault  7  and  Vault  8  disclosures,  did  WikiLeaks  ever 
publish  any  source  code? 

A.  As  far  as  I  know,  they  have  not. 

MR.  DENTON:  Nothing  further,  your  Honor. 

THE  COURT:  Ms.  Shroff. 

CROSS-EXAMINATION 
BY  MS .  SHROFF : 

Q.  Mr.  Rosenzweig,  you've  never  personally  spoken  to  anyone  at 
WikiLeaks,  correct? 

A.  At  where?  I'm  sorry.  I  didn't  catch  — 

THE  COURT:  WikiLeaks. 

THE  WITNESS:  WikiLeaks. 

A.  No,  not  that  I  know  of. 

Q.  Well,  you'd  know  who  you've  talked  to,  correct? 

A.  Right,  but  I  don't  know  who  WikiLeaks  members  are.  They 
don't  announce  themselves. 
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Q.  So  your  testimony  today  is  you  could  have  talked  to 
somebody  from  WikiLeaks  — 

A.  I  don't  — 

Q.  —  but  you  just  don't  know? 

A.  Nobody  has  ever  told  me  that  they  are  a  member  of 
WikiLeaks . 

Q.  So  as  far  as  you  know,  you  have  spoken  to  no  one  who  works 
at  WikiLeaks? 

A.  As  far  as  I  know,  I've  never  spoken  to  anyone  who's  told  me 
that  they  are  from  WikiLeaks. 

Q.  And  you've  never,  obviously,  worked  at  WikiLeaks,  correct? 
A.  That's  correct. 

Q.  You  have  no  personal  interaction  with  WikiLeaks,  correct? 

A.  Correct. 

Q.  And  all  of  the  information  that  you  have  about  WikiLeaks 
comes  from  reading  what  other  people  tell  you  about  WikiLeaks, 
correct? 

A.  What  WikiLeaks  tells  me  about  WikiLeaks,  but  yes. 

Q.  Well,  not  just  what  WikiLeaks  tells  you,  right?  What  other 
people  tell  you  about  WikiLeaks,  correct? 

A.  Correct. 

Q.  And  you've  never  had  any  personal  interviews  or  any 
interactions  with  United  States  officials  regarding  WikiLeaks 
before,  correct? 

A.  Before  this  interaction  here? 
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Q.  Right. 

A.  That's  correct. 

Q.  Right.  So  the  FBI's  never  consulted  with  you  about 
WikiLeaks,  correct? 

A.  That's  correct. 

Q.  The  CIA's  never  consulted  with  you  about  WikiLeaks, 
correct? 

A.  That's  correct. 

Q.  Foreign  nations  have  never  consulted  with  you  about 
WikiLeaks,  correct? 

A.  That's  correct. 

Q.  The  State  Department's  never  hired  you  as  their  expert  on 
WikiLeaks,  correct? 

A.  Correct. 

Q.  And  it's  fair  to  say  that  you  personally,  as  you  testified, 
do  not  know  the  contents  of  WikiLeaks's  disclosures,  correct? 

A.  That's  correct. 

Q.  And  you  testified  that  that's  because  you  have  an  inactive 
clearance,  correct? 

A.  And  because  it  was  outside  my  area  of  expertise,  but  yes. 

Q.  So  what  WikiLeaks  releases  is  outside  your  expertise, 
correct? 

A.  No.  The  substance  of  this  release  is  outside  my  area  of 
expertise.  I'm  not  a  computer  scientist.  I  don't  know  the 
forensics . 
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1  MS.  SHROFF:  Could  you  just  pull  up  for  me,  please, 

2  the  various  names  the  government  had  on  the  readout  to  each 

3  program.  Let  me  see,  starting  on  the  Vault  7. 

4  Q.  Your  testimony  was  you  have  an  inactive  clearance,  which 

5  precluded  you  from  reading  anything  about  these  leaks,  correct? 

6  A.  That's  one  of  the  two  reasons  why  I  haven't  read  these  — 

7  Q.  Let's  just  focus  on  the  first  reason,  the  inactive 

8  clearance.  Correct? 

9  A.  Actually,  that's  the  second  reason,  but  yes. 

10  Q.  Then  let's  start  with  the  second  reason.  Are  you  with  me? 

11  A.  Yeah. 

12  Q.  So  who  grants  you  clearance? 

13  A.  The  U.S.  government. 

14  Q.  Who  in  the  U.S.  government? 

15  A.  My  clearance  is  held  by  the  Department  of  Homeland  Security 

16  at  the  moment. 

17  Q.  Right.  And  when  the  Department  of  Homeland  Security  holds 

18  your  clearance,  you  worked  for  somebody  in  the  Department  of 

19  Homeland  Security,  right?  Michael  Chertoff,  correct? 

20  A.  I  did. 

21  Q.  Right.  And  Michael  Chertoff  and  you  started  a  company 

22  together  after  that,  correct? 

23  A.  No. 

24  Q.  You  didn't  start  a  company  together? 

25  A.  No. 
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Q.  Did  you  work  for  him? 

A.  I'm  a  senior  adviser  to  a  company  that  he  started. 

Q.  Right. 

A.  He  started  it  with  his  chief  of  staff,  Chad  Sweet.  I  work 
for  them  now  and  then  on  projects. 

Q.  OK. 

A.  But  I  didn't  start  a  company  with  him,  and  I'm  not  an 
employee  of  his  company. 

Q.  Are  you  a  consultant  to  his  company? 

A.  I'm  an  senior  adviser  to  his  company. 

Q.  What  does  that  mean? 

A.  It  means  that  at  times  if  there  are  projects  to  which  I  can 
add  value,  they  will  retain  me  as  an  additional  participant, 
independent  of  them.  If  I  get  cases,  matters  that  are  too 
large  for  me,  I  will  refer  it  to  them,  because  they're  a  big 
company.  I'm  a  small,  one-man  shop. 

Q.  It's  basically  you  give  them  business,  they  give  you 
business,  correct? 

A.  It ' s  a  cooperative  business  relationship,  yes. 

Q.  And  how  much  do  they  pay  you,  by  the  way? 

A.  Who? 

Q.  The  Michael  Chertoff  company.  How  much  do  they  pay  you  an 
hour? 

MR.  DENTON:  Objection. 

THE  COURT:  Overruled. 
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A.  They  don't  pay  me  by  the  hour. 

Q.  OK.  What's  the  flat  fee? 

A.  Depends  on  the  size  of  the  project. 

Q.  Give  us  a  range. 

A.  The  current  project  I'm  working  on  right  now  will  pay  me 
$25,000  this  year. 

Q.  Now,  going  back  to  the  clearance  that  you  said  is  held  by 
homeland  security,  you  are  an  expert  for  the  Department  of 
Justice  here,  correct? 

A.  I've  been  retained  by  the  Department  of  Justice,  yes. 

Q.  Right.  And  that's  the  United  States  Attorney's  Office, 
correct? 

A.  That's  correct. 

Q.  That's  under  the  umbrella  of  the  Department  of  Justice, 
correct? 

A.  Yes. 

Q.  And  they  could  certainly  give  you  clearance  to  look  at 
these  disclosures,  correct? 

A.  I  don't  know. 

Q.  You  don't  know? 

A.  I  don't  know  who  would  be  authorized  to  grant  me  a 
clearance  to  look  at  these  matters. 

Q.  I  didn't  ask  you  if  you  know  who.  I  just  asked  you  if  they 
would  be  one  of  the  people  who  could  give  you  permission  to 
look  at  them. 
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A.  I  don't  know  if  they  have  that  authority. 

Q.  You're  a  national  security  expert,  right? 

A.  I  don't  know  who  controls  the  security  clearance  for  this 
particular  piece.  My  experience  is,  actually,  that 
authorization  is  typically  quite  limited.  I  suspect,  since 
you're  asking,  that  they  —  the  gentlemen  there  —  do  not  have 
the  authority  to  grant  me  that  clearance. 

Q.  I  didn't  ask  you  if  the  gentlemen  there  have  the  authority, 
sir.  I  asked  you  if  the  Department  of  Justice  had  authority. 

A.  I  don't  know. 

Q.  OK.  Let's  just  go  with  that.  You  don't  know  if  you  could 
get  access  to  read  any  one  of  these  disclosures,  correct? 

A.  That's  what  I  just  said. 

Q.  OK.  Let's  start  with  Vault  7  that  he  had  you  read,  CIA 
hacking  tools  revealed.  All  you  saw  is  this  particular 
disclosure,  correct? 

A.  Correct. 

Q.  You  don't  know  anything  about  what  it  disclosed,  correct? 

A.  I  —  nothing  beyond  what  is  on  this  —  what  is  —  what  is 
here,  no. 

Q.  So  you  don't  even  know  if,  in  fact,  the  CIA  hacking  tools 
were  revealed,  correct? 

A.  I  do  not  know  from  this,  no. 

Q.  Right.  And  you  do  not  know  if  Project  Dark  Matter  was 
released,  correct? 
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A.  There  have  been  — 

Q.  No,  no.  Do  you  know  or  do  you  not  know  if  anything  about 
Project  Dark  Matter  was  actually  released  by  WikiLeaks?  That's 
the  question. 

A.  I  have  read  public  reports  to  that  effect,  yes. 

Q.  But  you  do  not  know? 

A.  I  do  not  know  personally,  no. 

Q.  Right.  This  is  only  about  what  you  know,  sir,  not  about 
what  the  world  knows. 

MS.  SHROFF:  Let's  turn  to  the  next  one.  Marble 
Framework . 

Q.  Again,  you  do  not  know,  correct? 

A.  Only  from  public  reports. 

Q.  It's  a  question  about  — 

A.  No,  because  —  I  mean,  I'm  sorry,  but  as  an  academic,  I 
rely  exclusively  on  public  reports.  I  have  read  public  reports 
that  these  did  include  hacking  tools.  I  have  not  examined  the 
tools  themselves,  no,  but  — 

Q.  So  if  the  — 

A.  But  that,  that  is  —  when  you  say  you  do  not  know,  the 
sources  from  which  I  normally  gain  information  have  told  me  so. 
I  have  no  reason  to  doubt  them,  but  I  have  not  verified  them 
any  more  than  I  know  the  results  of  the  Iowa  election  tomorrow. 
Q.  But  that's  not  really  true,  correct?  Because  if  you  wanted 
to  know  the  results  of  the  Iowa  election,  you  could  actually 
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1  look  at  the  tally  of  the  Iowa  elections,  correct? 

2  A.  I  don't  think  so.  I  don't  have  them. 

3  Q.  You  couldn't? 

4  A.  I  don't  have  them.  I  would  rely  on  public  reports. 

5  Q.  OK.  So  let's  just  keep  going  with  your  reliance  on  public 

6  reports.  If  The  New  York  Post  told  you  that  Project  Dark 

7  Matter  was,  in  fact,  released  by  WikiLeaks,  you  would  believe 

8  The  New  York  Post? 

9  A.  Not  necessarily. 

10  Q.  So  then  you  would  make  a  decision  as  to  whether  or  not  you 

11  would  actually  believe  the  secondary  source  about  the  leak  that 

12  is  titled  Project  Dark  Matter? 

13  A.  That's  the  function  that  I'm  supposed  to  function  at. 

14  Q.  Well,  so  — 

15  A.  Evaluation  of  secondary  sources.  Primary  sources  reach 

16  conclusions. 

17  Q.  Well,  you  didn't  check  the  primary  source,  correct? 

18  A.  I  was  asked  —  I  was  told  I  cannot  check  this  primary 

19  source. 

20  Q.  No.  You  did  not  check  the  primary  source,  correct? 

21  A.  I  did  not. 

22  Q.  Right.  And  you  did  not  check  the  primary  source  for  Marble 

23  Framework,  correct? 

24  A.  Correct. 

25  Q.  And  you  did  not  check  the  primary  source  for  — 
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MS.  SHROFF:  Next  screen,  please. 

Q.  —  Grasshopper  Framework,  correct? 

A.  Yes. 

Q.  In  fact,  all  you  know  is  that  might  just  tell  you  about  the 
different  kinds  of  grasshoppers  there  are  in  the  government, 
correct;  you  just  don't  know? 

A.  I  only  know  what  is  on  the  screen. 

Q.  Right. 

A.  WikiLeaks  has  said  that's  not  what  it  is. 

Q.  But  you  are  basically  reading  a  screen  from  WikiLeaks,  and 
that's  it,  correct? 

A.  That's  correct. 

Q.  OK.  Now,  you  testified  that  you  rely  on  secondary  sources 
only,  correct? 

A.  Correct. 

Q.  Right.  So  if  the  secondary  source  is  wrong,  you  are  wrong, 
correct? 

A.  Correct. 

Q.  And  if  the  secondary  source  is  right,  you  are  right, 
correct? 

A.  Correct. 

Q.  And  you  decide  which  secondary  source  you  are  going  to  rely 
on,  correct? 

A.  In  general,  yes. 

Q.  Right.  And  you,  it  would  be  fair  to  say,  have  a  specific 
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1  bias  when  you  read  a  secondary  source;  all  of  us  do,  but 

2  certainly  you  admit  you  do,  right? 

3  A.  I  don't  know  what  you  mean  by  bias. 

4  Q.  All  right. 

5  A.  I  have  sources  that  I  trust  more  than  others  based  on  prior 

6  experience. 

7  Q.  Thank  you. 

8  A.  Yes. 

9  Q.  All  right.  Let's  start  with  your  prior  experience. 

10  You're  a  lawyer,  you  testified,  correct? 

11  A.  Yes. 

12  Q.  Right.  And  you  started  your  career,  much  like  the 

13  prosecutors  here,  by  being  a  federal  prosecutor,  correct? 

14  A.  Yes. 

15  Q.  You  worked  for  the  United  States  Attorney's  Office, 

16  correct? 

17  A.  No.  The  Department  of  Justice  environmental  crimes 

18  section.  Environment  and  natural  resources  division. 

19  Q.  Right.  You  worked  for  the  United  States,  correct? 

20  A.  Yes. 

21  Q.  And  you  worked  for  them  as  a  prosecutor  for  about  seven 

22  years,  correct? 

23  A.  Yes. 

24  Q.  OK.  And  after  that,  you  went  and  got  a  job  at  something 

25  called  the  Heritage  Foundation,  correct? 
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A.  That  was  many  years  later. 

Q.  As  many  years  later  as  it  was,  you  got  a  job  at  the 
Heritage  Foundation,  correct? 

A.  That's  correct. 

Q.  Tell  the  jury  what  is  the  Heritage  Foundation? 

A.  It ' s  a  think  tank  in  Washington,  D.C. 

Q.  What  kind  of  think  tank? 

A.  I'm  not  sure  what  you  mean.  It  is  a  think  tank  that 
advances  generally  conservative  views  on  issues  relating  to 
everything  from  tax  policy  to  education  to  national  security. 

Q.  Right.  It's  called,  you  would  say,  a  conservative, 
right-wing  think  tank,  correct? 

A.  I  would  call  it  a  conservative  think  tank. 

Q.  Not  a  right-wing  think  tank? 

A.  Not  when  I  worked  there. 

Q.  I  didn't  ask  you  when  you  worked  there  or  not.  My  question 
to  you  is,  is  the  Heritage  Foundation  known  as  a  conservative, 
right-wing  organization? 

A.  I  don't  know. 

Q.  You  don't  know? 

A.  It  is  a  conservative  think  tank.  It's  a  self-described 
conservative  think  tank,  yes. 

Q.  Let's  talk  about  what  agenda  the  Heritage  Foundation 
promoted.  OK  right? 

MR.  DENTON:  Objection,  your  Honor. 
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THE  COURT:  Sustained. 

MS.  SHROFF:  Your  Honor,  it  shows  bias. 

THE  COURT:  Sustained. 

BY  MS .  SHROFF : 

Q.  Is  it  fair  to  say,  sir,  that  your  bias  includes  minimizing 
the  risk  of  gun  violence? 

MR.  DENTON:  Objection. 

THE  COURT:  Sustained. 

BY  MS .  SHROFF : 

Q.  It  minimizes  climate  change,  correct? 

THE  COURT:  Sustained.  Try  to  stay  to  something 
relevant,  please. 

MS.  SHROFF:  Your  Honor,  it  is.  Bias  is  always 

relevant . 

THE  COURT:  The  objection  has  been  sustained. 

BY  MS .  SHROFF : 

Q.  When  you  worked  for  the  Department  of  Homeland  Security, 
that  was  from  2005  to  2009,  correct? 

A.  Yes. 

Q.  And  that  was  under  President  George  W.  Bush,  correct? 

A.  Yes. 

Q.  And  when  you  worked  for  George  W.  Bush,  you  worked  on 
issues  about  border  security  and  immigration,  correct? 

A.  Amongst  many  others,  yes. 

Q.  OK.  And  when  President  Obama  got  the  job  after  George 
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Bush,  you  were  fired  from  that  administration,  correct? 

A.  All  political  appointees  leave  their  job  at  the  end  of  a 
presidential  term,  yes. 

MS.  SHROFF:  I  move  to  strike,  your  Honor,  and  I  ask 
that  the  witness  be  instructed  to  answer  the  question  asked. 

THE  COURT:  That  was  a  good  answer.  The  application 
is  denied. 

BY  MS .  SHROFF : 

Q.  You  were  fired,  correct? 

A.  No,  I  wasn't  fired. 

Q.  You  weren't  fired  by  the  Obama  administration;  you 
continued  to  work  for  them? 

A.  Well,  since  you  ask,  I  was  asked  to  resign  by  the  chief  of 
staff  to  President  George  W.  Bush  who  told  all  political 
appointees  to  submit  letters  of  resignation  that  the  Obama 
administration  was  free  to  accept  or  reject,  as  they  saw  fit. 

Q.  They  did  accept  yours,  right? 

A.  A  number  of  my  colleagues  continued  on. 

Q.  Did  they  accept  yours,  sir? 

A.  Yes. 

Q.  Thank  you. 

Now,  after  you  were  let  go  by  the  Obama  administration,  you 
then  worked  for  Michael  Chertoff  or  with  Michael  Chertoff; 
that's  when  your  relationship  with  Mr.  Chertoff  started, 
correct? 
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A.  Not  immediately,  no. 

Q.  Shortly  thereafter? 

A.  It  was  about  a  year  later  that  I  took  a  senior  adviser 
position  with  them. 

Q.  OK.  And  is  it  fair  to  say,  sir,  that  throughout  2007, 
while  you  were  working  for  the  Bush  administration,  WikiLeaks 
published  many  a  material  that  was  personally  and 
professionally  embarrassing  to  the  Bush  administration? 

A.  I  don't  know  about  personally,  but  professionally  for  sure. 
Q.  Right.  So  WikiLeaks  embarrassed  the  Bush  administration  by 
publishing  a  copy  of  the  standard  operating  procedures  for  the 
Bush  detention  center,  which  is  called  Guantanamo  Bay,  correct? 
A.  That's  correct. 

Q.  And  George  Bush  wanted  nothing  more  than  to  keep  the 
torture  at  Guantanamo  Bay  secret,  correct? 

MR.  DENTON:  Objection. 

THE  COURT:  Sustained. 

BY  MS .  SHROFF : 

Q.  Is  it  fair  to  say,  sir,  that  for  all  the  years  you  worked 
for  the  Bush  administration,  WikiLeaks  was  nothing  but  a  thorn 
in  their  side? 

A.  I  wouldn't  know  how  they  would  characterize  it.  I  wouldn't 
characterize  it  that  way. 

Q.  I  see.  Did  you  not  personally  believe  that  it  was 
important  to  keep  Guantanamo  Bay  open  and  any  information  about 
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1 

it  should  not  be  shared  with  the  American  public? 

2 

MR.  DENTON:  Objection. 

3 

THE  COURT:  Sustained. 

4 

MS.  SHROFF:  Your  Honor,  may  we  have  a  sidebar? 

5 

THE  COURT :  No . 

6 

MS.  SHROFF:  It's  time  for  our  lunch  break  anyway. 

7 

THE  COURT:  No.  No.  No.  Go  ahead. 

8 

BY  MS .  SHROFF : 

9 

Q.  You  worked  for  Lawfare,  correct? 

10 

A.  I  still  do,  yes. 

11 

Q.  And  in  2005,  you  wrote  a  blog  or  an  article  for  Lawfare, 

12 

correct? 

13 

A.  I  write  for  them  all  the  time.  I  don't  know  which  one 

14 

you're  referring  to.  Yes. 

15 

Q.  I'm  referring  to  the  one  where  you  talked  about  the 

16 

hysterical  claims  of  prisoner  abuse.  Does  that  ring  a  bell  for 

17 

you? 

18 

A.  Actually,  no. 

19 

Q.  OK. 

20 

A.  But  I  certainly  won't  deny  it  if  it's  got  my  name  on  it. 

21 

Q.  I  see.  So  you  remember  writing  an  article.  I'm  going  to 

22 

put  it  up  for  you  so  perhaps  your  recollection  can  be 

23 

refreshed . 

24 

MR.  DENTON:  Your  Honor,  I'm  going  to  object  to  this 

25 

line  of  questioning. 
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1 

MS.  SHROFF:  It  goes  to  his  bias,  your  Honor. 

2 

THE  COURT:  The  objection  is  overruled. 

3 

We'll  go  a  little  bit  longer.  What's  the  question. 

4 

Ms.  Shroff? 

5 

BY  MS .  SHROFF : 

6 

Q.  The  question  is  during  the  Bush  administration,  when 

7 

WikiLeaks  released  information  about  the  conditions  at 

8 

Guantanamo  Bay,  you  objected,  correct? 

9 

A.  To  what? 

10 

Q .  I'm  sorry . 

11 

A.  I'm  sorry.  I  objected  to  what? 

12 

Q.  The  release  of  the  information.  Right? 

13 

A.  No . 

14 

Q.  You  didn't?  You  did  not  object  to  the  release  of 

15 

information  and  say  that  there  was  little  evidence  to  back  it 

16 

up  and  the  information  should  not  be  made  public? 

17 

A.  In  this  article? 

18 

Q.  No.  I'm  just  asking  generally.  During  that  time  frame,  is 

19 

that  not  what  your  position  was  through  the  Bush 

20 

administration? 

21 

A.  I'm  sorry.  What  is  the  quote  that  you're  reading?  Or 

22 

could  you  read  the  quote  again? 

23 

Q.  You  characterized,  did  you  not,  the  claims  about  Guantanamo 

24 

Bay  abuse  as  frequent  and  hysterical  claims  with  little 

25 

evidence  to  back  them  up.  Isn't  that  correct? 
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A.  This  is  from  2005,  which  is  before  I  was  in  the  Bush 
administration.  You  confused  me  by  saying  that. 

Q.  OK.  Could  you  take  a  look  at  the  highlighted  section  that 
I  put  up  for  you? 

A.  Yes. 

Q.  You  wrote  that,  right? 

A.  Yes. 

Q.  In  the  face  of  public  information  that  WikiLeaks  released 
about  the  abuse  at  Guantanamo  Bay,  you  wrote  and  called  those 
claims  frequent  and  often  hysterical,  correct? 

A.  No.  This  article  predates  WikiLeaks's  release  of  the 
Guantanamo  Bay  information  that  you're  talking  about. 

Q.  OK. 

A.  So  you've  got  the  timing  mixed  up. 

(Continued  on  next  page) 
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Q.  Right.  Let's  try  and  see  if  you  can  help  me  out.  The  Bush 

2 

administration  took  great  umbrage  at  the  release  by  WikiLeaks 

3 

of  any  information  about  Guantanamo  Bay,  correct? 

4 

A.  I  didn't  participate  in  that. 

5 

Q.  You  worked  for  the  Bush  administration,  right? 

6 

A.  It's  300,000  political  appointees  in  every  political 

7 

administration.  WikiLeaks  was  not,  during  the  administration. 

8 

that  wasn't  my  issue. 

9 

Q.  You  are  a  WikiLeaks  expert,  sir. 

10 

A.  I've  been  —  what  do  you  want  me  to  say?  The  judge  has  — 

11 

I've  been  qualified  as  one,  yes. 

12 

Q.  Right.  And  to  qualify  as  an  expert,  you  went  back  and 

13 

looked  at  all  of  the  WikiLeaks  posts,  correct? 

14 

A.  Correct. 

15 

Q.  You  read  about  their  Twitter  feed,  correct? 

16 

A.  Yes. 

17 

Q.  You  read  about  all  of  their  exploits,  correct? 

18 

A.  Yeah. 

19 

Q.  You  put  together  charts,  correct? 

20 

A.  Yes. 

21 

Q.  Right.  And  you're  telling  this  jury  that  in  all  of  that 

22 

work  that  you  did,  you  did  not  go  back  and  check  to  see  if 

23 

WikiLeaks  released  information  about  Guantanamo  Bay  during  the 

24 

Bush  administration. 

25 

A.  I  did  not  say  that. 
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Q.  I'm  asking  you  the  question.  Did  you  or  did  you  not,  as 

2 

the  WikiLeaks  expert,  for  the  United  States  of  America,  review 

3 

that  information? 

4 

A.  WikiLeaks  released  information  about  Guantanamo  Bay  during 

5 

the  Bush  administration.  Correct. 

6 

Q.  Okay.  Let's  — 

7 

A.  That's  correct. 

8 

Q.  Throughout  your  time  studying  WikiLeaks,  you  personally 

9 

have  advocated,  have  you  not,  for  stringent  criminal  laws  to 

10 

prosecute  Assange,  correct? 

11 

A.  I  have  advocated  for  the  application  of  the  espionage  laws 

12 

in  this  context,  yes. 

13 

Q.  And  the  context  is  to  prosecute  Julian  Assange,  correct? 

14 

A.  That's  the  possibility  that  was  being  discussed,  yes. 

15 

Q.  And  you  advocated  for  that,  correct? 

16 

A.  Correct. 

17 

Q.  Right.  And  you  wrote  an  online  publication  about  that. 

18 

correct? 

19 

A.  I  wrote  several  publications,  yes. 

20 

Q.  Right.  In  2010,  you  argued  that  the  laws  should  be 

21 

updated,  correct? 

22 

THE  COURT:  The  law  being? 

23 

MS.  SHROFF:  The  law  to  prosecute  Julian  Assange. 

24 

Q.  You  advocated  for  that,  correct? 

25 

A.  The  Espionage  Act. 
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Q. 

Yes  . 

A. 

The  Espionage  Act  is  out  of  date. 

Q. 

That's  your  personal  opinion,  correct? 

A. 

It's  mine  and  many  others;  but  yes. 

it  is  mine. 

Q. 

We're  only  talking  about  you,  sir. 

today . 

A. 

That ' s  right . 

Q. 

Okay.  It's  yours,  right? 

A. 

Yes  . 

Q. 

Okay.  Congress  hasn't  listened  to 

you  and 

updated  right 

now. 

correct? 

A. 

Not  yet,  no. 

Q. 

So,  in  2013,  correct,  you  wrote  an 

article 

about  it. 

correct? 

A.  I  think  it  was  2010,  but  — 

Q.  Okay.  In  2010,  you  wrote  about  it,  and  you  thought  that 
the  American  government  should  shut  down  WikiLeaks,  correct? 

A.  I  don't  remember  what  I  —  what  precisely  I  said  in  the 
article . 

Q.  All  right.  Well,  you're  here  now.  Do  you  think  the 
American  government  should  shut  down  WikiLeaks? 

A.  No . 

Q.  You  do  not  now  think  that  the  American  government  should 
shut  down  WikiLeaks? 

A.  No . 

Q.  So  as  the  WikiLeaks  expert  who  just  testified  about  all  the 
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harm  to  the  United  States,  your  position  is  that  the  United 
States  government  should  not  shut  down  WikiLeaks? 


A. 

No. 

Q. 

Okay . 

"No" 

meaning  that's  not  your  opinion? 

A. 

No  meaning 

that  the  —  no,  meaning  you're  correct. 

I  do 

not  think  today  that  the  U.S.  government  should  shut  down 
WikiLeaks . 

Q.  So  according  to  your  expertise,  WikiLeaks  website  should 
remain  up,  correct? 

A.  If  that's  the  consequence  of  not  shutting  them  down,  yes. 
Q.  It  should  allow  for  the  dissemination  of  information, 
correct? 

A.  Some,  yes. 

Q.  Well,  only  some? 

A.  I  do  not  think  that  the  U.S.  government  should  be  in  the 
business  of  shutting  down  a  private  organization.  I  do  think, 
however,  that  individuals  in  that  private  organization  should 
be  responsible  for  what  they  publish,  and  if  in  doing  so  they 
violate  the  law,  then  they  should  suffer  those  legal 
consequences . 

So  what  I've  come  to  conclude  is  that  there  is  a 
balance  between  freedom  and  transparency  on  one  hand  and  the 
criminal  law  on  the  other.  So  case-by-case  basis  is  my  best 
answer  for  you. 

Q.  I  see.  So,  your  testimony  today  is  that  WikiLeaks  is  a 
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private  organization.  Correct? 

A.  It's  not  a  governmental  organization. 

Q.  Just  a  simple  yes  or  no  will  do  the  job  and  will  go  faster 
for  you,  sir,  okay? 

A.  Yes. 

Q.  So  it  is  a  private  organization? 

THE  COURT:  He  said  it's  a  private  organization. 

Q.  Right? 

A.  Yes. 

Q.  It  releases  information,  correct? 

A.  Correct. 

Q.  And  as  you  testified  on  direct,  it  works  with  other 
newspapers  at  times  to  properly  publish  this  information, 
correct? 

A.  It  has  in  the  past,  yes. 

Q.  So  it's  worked  with  The  New  York  Times,  correct? 

A.  In  the  past,  yes. 

Q.  Right.  You  don't  know  what  it's  going  to  do  in  the  future? 
A.  That's  right. 

Q.  So  it's  worked  with  The  Wall  Street  Journal,  correct? 

A.  I  don't  remember  that  one. 

Q.  Okay.  Well,  let's  try,  since  you  are  the  expert,  tell  us 
what  are  the  newspapers  it's  worked  with. 

A.  I  know  it's  worked  with  The  Times,  The  Washington  Post,  it 
has  work  in  the  past  with  The  Guardian  in  the  U.K. 
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Q.  And  you  agree  then  now  that  WikiLeaks  serves  a  purpose. 

2 

correct? 

3 

A.  Yes. 

4 

Q.  Now,  at  times,  when  these  other  newspapers  such  as  the  ones 

5 

you  just  mentioned,  for  example,  Washington  Post,  when  The 

6 

Washington  Post  published  information  that  you  did  not  like. 

7 

you  also  wrote  an  editorial  and  called  it  "Stop  Leaking, " 

8 

correct? 

9 

A.  Correct. 

10 

Q.  Right.  And  that  was  The  Washington  Post  that  published  a 

11 

transcript  of  President  Donald  Trump's  phone  calls  with  foreign 

12 

leaders,  correct? 

13 

A.  Correct. 

14 

Q.  And  you  wrote  with  great  umbrage  and  told  The  Washington 

15 

Post  and  others  to  stop  publishing  this  information,  correct? 

16 

A.  Incorrect. 

17 

Q.  Okay. 

18 

A.  I  said  that  the  people  who  were  releasing  it  to  The  Post 

19 

should  stop  doing  so.  The  Post  as  a  news  organization  is  not 

20 

who  I  was  talking  to.  It  was  to  the  members  of  the  NSC  who 

21 

were  leaking  the  transcripts  of  the  president's  calls. 

22 

Q.  Right.  And  — 

23 

THE  COURT:  Ms.  Shroff,  would  this  be  a  convenient 

24 

place  to  break  for  lunch? 

25 

MS.  SHROFF:  Whenever  the  Court  wants. 
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THE  COURT:  We're  going  to  take  a  break  now.  We'll 
resume  around  1:30. 

(Jury  excused) 

THE  COURT:  Mr.  Rosenzweig,  don't  talk  to  the 
government ' s  attorneys . 

THE  WITNESS:  Wouldn't  think  of  it,  your  Honor. 

THE  COURT:  Thank  you.  See  you  at  1:30. 

(Recess ) 

(Continued  on  next  page) 


SOUTHERN  DISTRICT  REPORTERS,  P.C. 
(212)  805-0300 


100 


K243SCH3 


1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 


AFTERNOON  SESSION 
1:40  p . m . 

(In  open  court;  jury  not  present) 

THE  COURT:  Before  we  bring  the  jury  in,  Ms.  Shroff, 
is  there  something  that  happened  at  lunchtime  that  you  want  to 
call  to  my  attention? 

MS.  SHROFF:  Oh  yes,  your  Honor.  I  did  call 
Mr.  Gonzalez.  Should  I  put  it  on  the  record  now? 

THE  COURT :  Do  you  want  to  put  it  on  the  record?  Put 
it  on  the  record  now,  yes. 

MS.  SHROFF:  Your  Honor,  we  had  thought  everybody,  all 
of  the  jurors  had  left  the  courtroom. 

THE  COURT:  Yes. 

MS.  SHROFF:  I  was  speaking  to  I  believe  my  colleagues 
and  my  expert . 

THE  COURT:  Yes. 

MS.  SHROFF:  When  I  turned  around,  I  saw  that  one  of 
the  jurors  had  walked  back  in. 

THE  COURT:  Yes. 

MS.  SHROFF:  I  told  my  expert  to  stop  talking.  And  I, 
we  all  stopped  talking,  and  then  we  called  Mr.  Gonzalez. 

THE  COURT:  What  do  you  want  me  to  do? 

MS.  SHROFF:  I  don't  want  you  to  do  anything.  I'm 
letting  you  know.  I  forgot  to  let  the  government  know.  1  just 
wanted  to  let  you  know. 
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THE  COURT:  Do  you  know  which  juror  it  was? 

MS.  SHROFF:  I  think  so.  I  think  it  was  the  juror 
with  the  cane,  because  it  took  a  while  for  the  person  to  leave. 
But  I  really  was  freaked  out,  so  I  didn't  pay  a  lot  of 
attention  to  who  it  was,  to  be  honest. 

THE  COURT:  That's  Ms.  Gallo  I  think. 

MS.  SHROFF:  I  think  it  was  the  last  alternate. 

Somehow  or  other  she  had  returned  back  to  the  courtroom  for 
some  reason. 

THE  COURT :  Do  you  think  she  heard  anything? 

MS.  SHROFF:  I  don't  know.  Honestly,  I  was  talking 
toward  my  expert  and  when  I  turned  is  when  I  saw  her. 

THE  COURT:  Which  voice  were  you  using,  your  low 
voice,  your  medium  voice? 

MS.  SHROFF:  I  don't  have  a  low  voice,  your  Honor.  It 
is  the  one  voice,  the  voice  that  my  mother  gave  me.  That's  all 
I  got.  I'm  pretty  sure  she  heard  me,  whatever  I  was  saying. 

THE  COURT:  What  were  you  talking  about? 

MS.  SHROFF:  I  think  I  might  have  been  asking  how  did 
I  do  on  cross.  I  don't  know.  I  mean,  you  know.  I  really 
don ' t  remember . 

THE  COURT:  I'm  being  serious  now.  If  you  were 
transmitting  confidential  information  or  legal  requirements, 
legal  information,  I'd  go  one  way.  If  you  were  just  saying  how 
am  I  doing,  and  trying  to  be  Ed  Koch,  how  am  I  doing. 
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MS.  SHROFF:  I  don't  know  who  Ed  Koch  is,  but  I  don't 
think  I  was  transmitting.  I  don't  think  —  I  think  we  were 
just  making  general  convo,  normal  stuff,  like  oh  my  God,  I 
can't  believe  I  have  to  do  this. 

THE  COURT:  Okay.  Well,  you  put  it  on  the  record. 

I'm  not  going  to  do  anything. 

MS.  SHROFF:  Thank  you,  your  Honor.  It  was  truly 
inadvertent,  obviously. 

(Continued  on  next  page) 


SOUTHERN  DISTRICT  REPORTERS,  P.C. 
(212)  805-0300 


103 


1 

K243SCH3  Rosenzweig  -  Cross 

(Jury  present) 

2 

THE  COURT:  Ms.  Shroff. 

3 

MS.  SHROFF:  Thank  you,  your  Honor. 

4 

BY  MS .  SHROFF : 

5 

Q.  Mr.  Rosenzweig,  I  am  going  to  turn  to  Government  Exhibit 

6 

1702  that  you  helped  prepare,  okay? 

7 

A.  Yes. 

8 

Q.  If  you  could  just  take  a  look  at  the  first  page  of  the 

9 

demonstrative . 

10 

A.  Yes. 

11 

Q.  This  is  the  compilation  that  you  put  together  along  with 

12 

the  prosecutors,  correct? 

13 

A.  They  assisted  me  in  putting  it  together,  yes. 

14 

Q.  Okay.  And  the  logo  on  the  top-left  side,  is  that  your  logo 

15 

or  the  WikiLeaks  logo? 

16 

A.  The  WikiLeaks  logo. 

17 

Q.  So  you  took  WikiLeaks'  logo  and  implanted  it  on  your 

18 

demonstrative;  is  that  correct? 

19 

A.  It's,  yes . 

20 

Q.  If  you  could,  who  chose  these,  OPCW  Douma,  Fishrot,  Popes 

21 

Orders.  Did  you  pick  it? 

22 

A.  WikiLeaks  did. 

23 

Q.  Who  picked  it? 

24 

A.  That's  a  screen  shot  of  the  first  page  as  it  existed  on  the 

25 

day  I  screen  shot  it.  So  that,  whatever  was  on  the  front  page 
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Rosenzweig  -  Cross 
from  WikiLeaks  is  what  I  depicted  here. 

Q.  And  is  it  fair  to  say  that  you  put  this  compilation 
together  and  sent  it  to  the  prosecutors,  correct? 

A.  I  gave  them  some  ideas,  they  sent  back  a  draft,  I  fixed  it, 
yes . 

Q.  You  and  the  prosecutors  e-mailed  each  other  back  and  forth 
about  this,  yes? 

A.  We  spoke  about  it.  I  must  have  sent  them  an  e-mail  as 
well,  yes. 

Q.  If  you  could  just  take  a  look  at  the  page  that's  titled 
"notable  leaks  before  2017." 

A.  Yes. 

Q.  That's  your  compilation,  correct? 

A.  That's  correct. 

Q.  WikiLeaks  has  never  put  it  together  this  way,  correct? 

A.  That's  correct. 

Q.  So  the  WikiLeaks  logo  on  the  left  side  is  not  really  the 
WikiLeaks  logo.  It's  you  putting  the  logo  on  there,  correct? 

A.  That's  correct. 

Q.  And  you  decided  which  one  of  these  topics  to  highlight, 
correct? 

A.  Yes. 

Q.  You  could  have  picked  any  of  them,  correct? 

A.  I  picked  the  most  notable  ones. 

Q.  Right.  That  you  thought  were  most  notable? 
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A.  That's  correct. 

2 

Q.  Okay.  It's  the  same  for  almost  every  one  of  the  pages 

3 

where  the  WikiLeaks  logo  is  on  the  left  side,  correct? 

4 

A.  That's  correct. 

5 

Q.  So  let's  go  to  the  one  where  it  says  WikiLeaks  and 

6 

Anonymous.  You  don't  know  anything  about  anonymous  either. 

7 

correct? 

8 

A.  I'm  sorry,  I  don't  understand. 

9 

Q.  Okay.  You  ever  met  anybody  who  is  in  the  Anonymous  hacker 

10 

group? 

11 

A.  Yes. 

12 

Q.  Did  you  talk  to  them  about  putting  this  demonstrative 

13 

together? 

14 

A.  No . 

15 

Q.  So  when  you  picked  out  this  quote,  "We  Anonymous  just 

16 

happen"  blah,  blah,  blah,  you  decided  to  put  that  quote  on. 

17 

correct? 

18 

A.  That's  correct. 

19 

Q.  And  nobody  told  you  to  have  a  different  quote  or  put 

20 

something  different  on  your  demonstrative,  because  you  only 

21 

discussed  it  with  the  government,  right? 

22 

A.  The  government  didn't  tell  me  what  to  put  on  either.  But 

23 

yes,  nobody  told  me  what  to  put  on. 

24 

Q.  Now,  let's  go  to  this  page  where  it  says  "Instruction  to 

25 

leakers:  overview." 
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A.  There  are  two  of  those.  Which  one  do  you  want? 

Q.  Let's  start  with  the  first  one.  Do  you  see  it  says  "submit 
documents  to  WikiLeaks"? 

A.  Yes. 

Q.  That's  on  the  WikiLeaks  website,  correct? 

A.  Correct. 

Q.  You  never  tried  to  upload  a  document  to  WikiLeaks,  correct? 
A.  That's  correct. 

Q.  And  so  you  don't  know  if  this  actually  works  out  properly, 
right? 

A.  Oh,  no.  I  did  go  to  the  web  page. 

Q.  I  didn't  ask  you  if  you  went  to  the  web  page.  I  am  asking 
if  you  know  how  to  upload  a  document  to  WikiLeaks. 

A.  You  asked  me  if  I  uploaded  documents,  the  answer  is  no,  but 
the  web  page  address  does  work. 

Q.  I  didn't  ask  you  if  the  address  worked.  I  am  asking  if  the 
actual  process  of  uploading  works.  You've  never  tried  it, 
correct? 

A.  That's  correct. 

Q.  You  don't  know  if  it  works,  correct? 

A.  That's  correct. 

Q.  Next  one,  "Instructions  to  leakers:  overview."  Right? 

A.  Yes. 

Q.  When  you  talked  about  this  IP  address,  you  testified  this 
is  an  unusual  IP  address;  is  that  right? 
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A.  I  don't  think  I  used  the  word  "unusual." 

2 

Q.  Okay.  What  word  did  you  use? 

3 

A.  It's  not  the  typical  one  that  the  average  citizen  would 

4 

see . 

5 

Q.  Okay. 

6 

A.  It  is  a  specific  address  for  the  Tor  Onion  network. 

7 

Q.  So  let's  talk  about  this.  Tor  and  Onion  network.  Where 

8 

does  Tor  come  from? 

9 

A.  It  was  invented  by  the  U.S.  government. 

10 

Q.  The  United  States  government  invented  Tor? 

11 

A.  Yes. 

12 

Q.  Okay.  Which  part  of  the  United  States  government? 

13 

A.  I  think  it  was  the  Navy,  but  I'm  not  one  —  I  don't  have 

14 

100  percent  recollection.  I  think  it  was  the  Navy. 

15 

Q.  Right.  So  the  Tor  was  invented  by  the  U.S.  Navy,  correct? 

16 

A.  By  the  U.S.  government.  I  am  not  100  percent  sure  it  was 

17 

the  Navy. 

18 

Q.  Who  funds  it  now.  Department  of  Defense? 

19 

A.  Tor  now?  No,  Tor  is  operated  by  the  Tor  Project,  which  is 

20 

an  independent  organization. 

21 

Q.  Who  contributes  to  its  activity? 

22 

A.  They  take  donations  from  people  who  use  it.  You  could  give 

23 

them  money  if  you  wanted. 

24 

Q.  Do  you  know  if  the  Department  of  Defense  helps  them  out? 

25 

A.  I  don't  know. 
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Q.  Do  you  know  if  the  State  Department  helps  them  out? 

2 

A.  I  believe  they  do.  I  believe  I  read  reports  that  they  do. 

3 

Q.  The  State  Department  you  know  helps  them  out,  correct? 

4 

A.  No,  I  believe  I've  read  reports  that  they  do. 

5 

Q.  Okay.  But  you  testified  before  that  whatever  reports  you 

6 

read,  you  then  make  a  decision  whether  to  believe  them  or  not. 

7 

correct? 

8 

A.  That's  correct. 

9 

Q.  Right.  So  do  you  believe  that  report  or  you  don't? 

10 

A.  I've  never  actually  formed  an  opinion  about  that. 

11 

Q.  You  are  testifying  as  the  WikiLeaks  expert  today  before 

12 

this  jury. 

13 

A.  You  are  asking  me  about  Tor  and  its  funding. 

14 

Q.  Right.  But  WikiLeaks  is  talking  about  Tor,  right? 

15 

A.  Yes. 

16 

Q.  You  testified  all  about  Tor  when  Mr.  Denton  was  asking  you 

17 

these  questions,  correct? 

18 

A.  Yes. 

19 

Q.  Did  they  ask  you  who  funds  Tor? 

20 

A.  No,  they  didn't. 

21 

Q.  Okay.  How  about  Tails? 

22 

A.  What  about  it? 

23 

Q.  Who  funds  Tails? 

24 

A.  I  don't  know. 

25 

Q.  Did  you  ever  try  to  find  out,  as  the  national  security 
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expert  that  you  are,  who  contributes  money  to  Tails? 

A.  No . 

Q.  Okay.  I  am  assuming  that  in  all  of  the  times  you  testified 
before  Congress,  you  never  asked  them  or  they  asked  you  who 
funds  Tor,  correct? 

A.  No . 

Q.  Okay.  So  let's  talk  about  Tor.  Who  else  uses  Tor, 
according  to  you? 

A.  Who  else  besides  WikiLeaks? 

Q.  Yeah. 

A.  Wide  range  of  institutions  and  organizations.  Some 
malicious,  like  criminals  and  terrorists;  some  well  meaning, 
like  journalists  and  protest  groups. 

Q.  So  let's  start  with  the  well  meaning.  How  about  The  New 
York  Times? 

A.  I  don't  know. 

Q.  How  about  Wall  Street  Journal? 

A.  I  don't  know. 

Q.  How  about  the  Department  of  Defense? 

A.  I  assume  so,  but  I  don't  know. 

Q.  How  about  the  State  Department? 

A.  I  don't  know. 

Q.  How  about  you? 

A.  Yes. 

Q.  You  use  Tor? 
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A.  Yes. 

2 

Q.  Okay.  Now,  let's  turn  to  this  page  that  you  see,  "Tor  the 

3 

Onion  router."  You  testified  about  how  Tor  works.  You  put 

4 

this  slide  together? 

5 

A.  This  one? 

6 

Q.  Right. 

7 

A.  The  graphic  is  from  the  Electronic  Freedom  Foundation,  and 

8 

the  Tor  logo  is  from  Tor. 

9 

Q.  Right.  You  put  together  this  demonstrative,  correct? 

10 

A.  Yes. 

11 

Q.  You  had  no  idea  if  this  is  how  Tor  actually  works,  correct? 

12 

A.  No . 

13 

Q.  You  don't  know  if  Alice  is  really  going  through  that  plus. 

14 

plus,  plus  and  getting  to  Bob  or  getting  to  Jane.  In  fact,  you 

15 

don't  know  anything  about  this  demonstrative,  correct? 

16 

A.  Literally  thousands  of  articles  have  been  written  about  how 

17 

Tor  operates.  And  this  is  a  depiction  of  how  every  one  of 

18 

those  articles  says  it  operates.  Including  articles  —  well. 

19 

So,  no,  I  don't  code  Tor.  But  yes,  this  is  how  it  operates. 

20 

Q.  You  don't  know  this  is  how  it  operates. 

21 

A.  Yes,  this  is  how  it  operates. 

22 

Q.  You  do  know  how  Tor  operates? 

23 

A.  As  I  said,  every  secondary  source  that  I  know  of  says  that 

24 

this  is  how  it  operates. 

25 

Q.  Okay.  So  if  you  were  to  read  a  secondary  source  on  heart 
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surgery,  you  would  know  how  heart  surgery  works,  according  to 

2 

you? 

3 

A.  No . 

4 

Q.  Okay.  Let's  move  on  from  Tor.  Let's  move  to  Tails.  You 

5 

use  Tails? 

6 

A.  I've  tried  it  once,  but  no,  I  don't  use  it  routinely. 

7 

Q.  How  about  The  New  York  Times? 

8 

A.  Don't  know. 

9 

Q.  Wall  Street  Journal? 

10 

A.  Don't  know. 

11 

Q.  Law  360? 

12 

A.  Don't  know. 

13 

Q.  Daily  News? 

14 

A.  No,  don't  know. 

15 

Q.  Washington  Post? 

16 

A.  Don't  know. 

17 

Q.  United  States  attorney's  office? 

18 

A.  I  don't  know. 

19 

Q.  Let's  go  to  the  screen  that  says  "instructions  to  leakers: 

20 

tips  .  " 

21 

By  the  way,  do  you  know  if  the  CIA  uses  Tor? 

22 

A.  I  don't  know. 

23 

Q.  You  read  this,  you  testified  about  this  page,  correct,  on 

24 

direct  ? 

25 

A.  Yes. 
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Q.  And  basically,  you  read  what  was  written  on  the  screen, 
right? 

A.  That  was  what  I  was  asked  to  do,  yes. 

Q.  And  then  you  said  that  this  is  WikiLeaks'  explanation, 
correct? 

A.  I  said  this  is  what  WikiLeaks  has  published. 

Q.  Okay. 

A.  Yes. 

Q.  Right.  Beyond  that,  you  don't  really  know  much,  right, 
about  this  screen? 

A.  Like  what?  I'm  sorry,  I  don't  understand  the  question. 

Q.  Well,  you  don't  really  know  if  it  works,  right?  That  if  a 
person  has  a  very  large  submission,  with  a  complex  format,  this 
is  how  you  should  move  forward.  You  don't  know  in  if  this 
works,  right? 

A.  I  know  what's  here.  I  know  they  say  contact  us. 

Q.  Right.  So  if  a  juror  read  it,  you  basically  know  what  a 
juror  knows  by  reading  this  screen? 

A.  In  this  particular  screen,  it's  self-explanatory,  yes. 

Q.  That's  not  what  I  asked  you.  I  asked  you  if  you  know 
anything  more  than  the  average  reader  of  this  screen  knows. 

A.  For  this  screen? 

Q.  Yes. 

A.  No . 

Q.  Okay.  Let's  go  to  the  screen  that  says  "solicitation  of 
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classified  information."  The  first  line  that  you  have  there, 
"WikiLeaks  as  a  whole,  and  Assange  in  particular,  has  actively 
promoted  leaking  of  classified  information." 

You  just  wrote  that  sentence  up,  right? 

A.  I  wrote  that  sentence,  yes. 

Q.  Okay.  That's  it,  right,  you  wrote  it? 

A.  That's  my  summary,  yes. 

Q.  Right.  You  put  the  WikiLeaks  logo  on  there  and  then  you 
wrote  that  sentence? 

A.  Yes. 

Q.  Okay.  And  then  you  pulled  out  two  quotes,  and  you  put 
those  in,  correct? 

A.  Correct. 

Q.  Okay.  And  you  chose  the  quotes,  right? 

A.  Yes. 

Q.  And  one  of  the  quotes  you  chose  was  specifically  about  this 
language  about  the  CIA,  right? 

A.  Correct. 

Q.  And  you  knew  this  case  was  about  the  CIA,  correct? 

A.  Correct. 

Q.  And  you  work  for  the  United  States  attorney's  office, 
correct? 

A.  I'm  contracted  to  them  as  an  expert  witness,  yes. 

Q.  By  the  way,  how  much  do  they  pay  you  per  hour? 

A.  $400  an  hour. 
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1 

Q.  $400  an  hour  to  talk  to  them? 

2 

A.  Yes. 

3 

Q.  $400  every  time  you  e-mail  them? 

4 

A.  I  don't  charge  for  every  minute  I  spend. 

5 

Q.  Okay.  $400  an  hour  to  testify  here  today? 

6 

A.  Yes. 

7 

Q.  Who  paid  for  you  to  come  up? 

8 

A.  They'll  pay,  they'll  reimburse  me  the  expenses. 

9 

Q.  Who  pays  for  you  to  stay  over? 

10 

A.  The  U.S.  attorney's  office  will  reimburse  me  for  the 

11 

expenses . 

12 

Q.  Okay.  And  they  paid  you  for  putting  all  of  this  together. 

13 

right? 

14 

A.  Yes. 

15 

Q.  They  paid  you  for  researching  the  quotes? 

16 

A.  Yes. 

17 

Q.  They  paid  you  for  the  compilation? 

18 

A.  Yes. 

19 

Q.  Let's  look  at  the  next  screen  where  it  talks  about  leak 

20 

practices.  You  said  "WikiLeaks  practices  with  respect  to 

21 

redaction  are  inconsistent."  Right? 

22 

A.  Yes. 

23 

Q.  Your  opinion,  correct? 

24 

A.  Yes. 

25 

Q.  You're  not  a  statistician,  correct? 
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A.  Not  a  statistician,  no. 

Q.  And  you  didn't  contract  out  a  statistician  to  help  you  come 
to  that  conclusion,  correct? 

A.  No . 

Q.  So  basically,  you  looked  at  WikiLeaks,  you  couldn't  figure 
out  a  pattern  to  the  redactions,  so  you  said  the  redactions  are 
inconsistent,  right? 

A.  No . 

Q.  You  didn't  see  a  pattern,  right? 

A.  That's  correct. 

Q.  Okay.  So,  when  you  didn't  see  a  pattern,  you  didn't 
contact  a  statistician.  You  just  concluded  that  they  were 
inconsistent? 

A.  No . 

Q.  Okay.  So  tell  us  what  you  did. 

A.  I  reviewed  all  of  them,  and  then  I  reviewed  the  other 
people's  analysis  of  them.  There  is  a  longstanding  series  of 
articles  that  have  reviewed  WikiLeaks'  redaction  patterns,  and 
most  of  those  reach  the  same  conclusion.  So  I  also  relied  on 
secondary  sources  that  support  this  summary. 

Q.  Okay.  So  you  looked  at  other  people's  analysis  of  the 
pattern  of  redactions,  and  then  you  decided  that  the  pattern  of 
redaction  was  inconsistent? 

A.  I  looked  at  other  people's  analysis,  I  looked  at  the 
historical  materials  myself,  and  both  of  those  led  me  to  the 
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conclusion  that  WikiLeaks  has  been  inconsistent  in  its 
application  of  redaction  rules. 

Q.  So  if  the  underlying  source  is  wrong,  you  are  wrong. 

A.  This  isn't  a  —  well,  that's  always  true.  But  this  isn't 
an  underlying  source.  I  read  the  original  materials  on 
WikiLeaks'  website  as  well  as  reading  secondary  sources,  so 
it's  not  exclusively  the  secondary  sources. 

Q.  So  you  looked  at  WikiLeaks'  redaction  pattern  from  2006  all 
way  to  2020,  you  made  a  graph  and  a  chart,  and  then  you  came  to 
this  conclusion? 

A.  No . 

Q.  So,  where  is  the  math? 

A.  I  don't  think  it  needs  math  to  say  that  something  is 
inconsistent . 

Q.  Exactly.  So  you  didn't  have  any  math,  you  didn't  have  any 
stats,  and  you  just  didn't  find  a  pattern,  so  you  call  it 
inconsistent . 

A.  1  think  that  anybody  who  reviews  it  would  reach  the  same 
conclusion.  But  if  they  wanted  to  say  there  was  a  consistency, 
we  could  have  a  discussion  about  that. 

Q.  Okay.  All  right.  Let's  move  on.  When  you  say  "WikiLeaks 
performs  minimal,  if  any,  analysis, "  again,  your  conclusion? 

A.  My  conclusion,  that  of  the  secondary  sources,  based  upon 
the  review  of  what  WikiLeaks  has  published,  and  what  others 
have  written  about  what  they've  published,  yes. 
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Q.  And  you  said  "WikiLeaks  does  not  review  all  leaked  material 

2 

it  posts."  You  have  no  way  to  know  that,  right? 

3 

A.  That's  what  WikiLeaks  has  said. 

4 

Q.  Right. 

5 

A.  So  I  assumed  that  when  they  declare  it  —  perhaps  they  are 

6 

lying  about  that  as  well. 

7 

Q.  Okay. 

8 

A.  So  perhaps  it  should  say  "WikiLeaks  says  it  does  not  review 

9 

all  leaked  materials  it  posts." 

10 

But  it  seems  to  be  consistent  with  their  practices  as 

11 

well . 

12 

Q.  You  think  it's  consistent? 

13 

A.  What? 

14 

Q.  You  think  it's  consistent? 

15 

A.  It  appears  as  though  they  have  not  done  that  in  the  past. 

16 

Yes  . 

17 

Q.  Okay.  The  next  sentence  you  have,  you  have  "WikiLeaks 

18 

sometimes  partners  with  traditional  media  organizations." 

19 

A.  Correct. 

20 

Q.  Right?  And  then  you  have  "WikiLeaks  takes  steps  to  protect 

21 

the  identity  of  sources."  Correct? 

22 

A.  That's  correct. 

23 

Q.  And  then  you  have  "The  vast  majority  of  WikiLeaks 

24 

disclosures  target  the  United  States."  Correct? 

25 

A.  Correct. 
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Q.  Okay.  Let's  talk  about  that.  The  first  set  of  documents 
that  WikiLeaks  ever  released  had  to  do  with  what  nation? 

A.  Somalia. 

Q.  And  not  America? 

A.  Somalia  is  not  America,  yes. 

Q.  One  thing  we  agree  on.  It  published  information  about  a 
Somali  rebel  leader's  plans  to  assassinate  Somali  government 
officials,  correct? 

A.  That's  right,  yes. 

Q.  It  published  information  identifying  a  corrupt  Kenyan 
leader  named  Mwai,  correct? 

A.  That's  correct.  That  was  in  2007  I  think. 

Q.  Right.  And  you  didn't  include  that  in  your  presentation, 
right? 

A.  No . 

Q.  Okay.  How  about  the  fact  that  WikiLeaks  published 
documents  revealing  corruption  in  Peru  around  the  management  of 
Peru's  oil  resources? 

A.  That's  correct. 

Q.  You  didn't  put  that  in  here  either,  right? 

A.  No . 

Q.  Published  a  report  detailing  a  nuclear  accident  in  Iran, 
correct? 

A.  I  don't  remember  that  one.  But  I  don't  disagree  with  you. 
Q.  You  didn't  put  it  in? 
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A.  No . 

Q.  Okay.  Published  documents  related  to  arms  deals  between  a 
French  company  and  the  UAE,  United  Arab  Emirates,  correct? 


A. 

I  believe 

that '  s 

correct,  yes. 

Q. 

Of  course 

it  is  . 

You  didn't  put  it  in,  right? 

A. 

No. 

Q. 

Okay.  How 

about 

all  of  those  e-mails  about  the  French 

presidential  campaign  of  Macron? 

THE  COURT:  Of  what? 

MS.  SHROEE :  Emmanuel  Macron. 

Q.  Did  you  put  them  in? 

A.  No . 

Q.  Oh.  What  country  is  that? 

A.  The  French  president  is  France. 

Q.  Right.  You  didn't  put  that  in  either,  right? 

A.  No . 

Q.  So  you  have  France,  Peru,  Iran,  Africa.  You  didn't  put  any 
of  those  in,  right? 

A.  No . 

Q.  Let's  keep  going.  How  about  all  of  the  information 
WikiLeaks  publishes  about  non-governmental  entities.  Focus  on 
those  at  all,  or  no,  skip  those? 

A.  Not  for  this  case,  no. 

Q.  Not  for  this  case? 

A.  No . 
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Q.  You  are  the  WikiLeaks  expert,  right?  You  want  to  give  a 

2 

fair  and  balanced  opinion  of  WikiLeaks,  right?  Or  no,  you  want 

3 

to  support  the  government  here.  I'll  take  that  back.  Let's 

4 

just  focus  on  what  you  didn't  focus  on. 

5 

How  about  Apple.  How  about  Apple's  restrictive 

6 

contracts  with  the  iPhone  application  developer  that  WikiLeaks 

7 

released.  Did  you  talk  about  that? 

8 

A.  No . 

9 

Q.  How  about  documents  that  WikiLeaks  released  that  relate  to 

10 

the  Church  of  Scientology? 

11 

A.  No . 

12 

Q.  By  the  way,  did  you  do  a  harm  analysis  on  those  documents? 

13 

A.  Not  for  this  case,  no. 

14 

Q.  Ever? 

15 

A.  No . 

16 

Q.  Okay.  How  about  WikiLeaks'  publishing  of  documents  showing 

17 

the  internal  power  struggle  with  the  Catholic  Church? 

18 

A.  I  did  not  include  them.  I  assume  there  is  a  question.  But 

19 

no,  I  did  not  include  them. 

20 

Q.  So,  we  have  at  least  five  or  six  governments,  and  I'm  not  a 

21 

WikiLeaks  expert.  I  mean,  I  just  Googled  it  and  found  this. 

22 

But  there  could  be  a  whole  ton  of  other  countries,  right? 

23 

THE  COURT:  Ms.  Shroff,  could  you  not  testify,  please. 

24 

MS.  SHROFF:  Sure. 

25 

Q.  Sitting  here  today  you  are  aware,  right,  that  WikiLeaks 
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publishes  information  all  over  the  world,  right? 

2 

A.  It  does. 

3 

Q.  Okay.  Let's  turn  to  the  WikiLeaks  Twitter  feed,  shall  we. 

4 

You  testified  about  that,  right?  You  testified  about  the  first 

5 

slide  which  looks  like  this  one. 

6 

A.  Yup . 

7 

Q.  That  started  on  February  4,  correct? 

8 

A.  Yes. 

9 

Q.  As  a  WikiLeaks  expert,  do  you  know  if  the  FBI  follows  the 

10 

WikiLeaks'  Twitter? 

11 

A.  I  do  not  know. 

12 

Q.  Do  you  know  if  the  CIA  follows  the  WikiLeaks'  Twitter? 

13 

A.  I  do  not  know. 

14 

MR.  DENTON:  I  am  going  to  object  to  this,  your  Honor. 

15 

THE  COURT:  Overruled. 

16 

Q.  You  testified,  sir,  that  you  did  not  read  Vault  7  because 

17 

it  was  code,  correct?  You  don't  understand  code? 

18 

A.  No,  I  testified  I  didn't  read  it  because  it  was  classified 

19 

and  because  that  wasn't  the  subject  of  my  expertise  today.  As 

20 

it  happens,  I  probably  wouldn't  understand  the  code  if  I  did 

21 

read  it,  as  I  —  to  the  extent  I  understand  what's  in  it,  seems 

22 

it's  beyond  my  understanding,  yes. 

23 

Q.  He's  charged  with  stealing  Vault  7  information,  correct? 

24 

A.  He  who? 

25 

Q.  Mr.  Schulte. 
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A.  I  don't  know  which  one  Mr.  Schulte  is. 

Q.  Okay.  I  didn't  ask  if  you  knew  who  Mr.  Schulte  was. 

A.  Oh,  yeah. 

Q.  I  simply  asked  if  you  knew  that's  what  you  knew  the  charges 
to  be . 

A.  That's  what  I  understand  the  case  is  about,  yes. 

Q.  And  you  testified  that  you  wouldn't  understand  Vault  7 
anyway  because  it  was  code,  right? 

A.  I  personally  would  probably  not  be  able  to  understand  it. 

Q.  Did  you  know  that  there's  no  code  in  Vault  7? 

A.  I  don't  know  what's  in  Vault  7. 

Q.  Did  you  read  The  New  York  Times  articles  about  Vault  7? 

A.  Probably  did  at  the  time  they  came  out. 

Q.  Okay.  Did  you  read  The  Wall  Street  Journal  articles  about 
Vault  7? 

A.  I  don't  read  The  Journal  regularly,  no. 

Q.  Okay.  So,  you  read  The  New  York  Times  articles  about 
Vault  7,  right? 

A.  Probably  did  when  they  came  out,  but  I  don't  remember. 

Q.  And  when  you  were  retained  here  on  this  case,  you  knew  it 
was  about  Vault  7  and  Vault  8,  right? 

A.  Of  course. 

Q.  And  you  took  no  steps  to  find  out  whether  or  not  you  were 
able  to  read  the  disclosure  of  Vault  7  and  Vault  8? 

A.  I  wasn't  asked  to,  no. 
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Q.  And  you  only  did  what  you  were  asked  to  do,  correct? 

A.  That's  correct. 

Q.  Let's  look  at  the  slide  where  you  have  "How  did  Vault  7 
make  its  way  to  WikiLeaks."  You  included  that  slide,  correct? 
A.  Yes. 

Q.  Okay.  You  have  no  idea  how  Vault  7  made  its  way  to 
WikiLeaks,  right? 


A. 

None . 

Q. 

None.  You  don't  know  how  it  got 

to 

WikiLeaks, 

correct? 

A. 

No. 

Q. 

You  don't  know  if  Russia  sent  it 

to 

WikiLeaks, 

correct? 

A. 

No. 

Q. 

You  just  put  the  slide  on  there 

because  you  thought  it 

would  make  a  nice  presentation? 

A.  No . 

Q.  Oh.  Okay.  Let's  look  at  the  next  one.  You  see  Vault  7, 
the  CIA  logo  there,  and  the  Twitter  feed  up  top? 

A.  Yes. 

Q.  You  took  a  screen  shot  and  put  it  as  part  of  your 
demonstrative,  correct? 

A.  Yes. 

Q.  And  you  testified  that  you  did  not  read  any  single 
disclosure,  correct? 

A.  That's  correct. 

Q.  Okay.  So  you  had  no  idea  whether  there's  code,  language. 
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1  articles,  or  whatever  else  is  in  each  one  of  these. 

2  Can  you  move  to  the  next  screen,  please.  Next  one. 

3  I  am  just  going  to  ask  you  any  one  of  these,  right. 

4  So  Hive,  Weeping  Angel,  Scribbles,  After  Midnight,  Athena.  You 

5  don't  know  what's  in  it  at  all.  Nobody  asked  you  to  verify? 

6  A.  That's  correct. 

7  Q.  You  don't  know  what's  in  them? 

8  A.  I  only  know  what  the  Twitter  feed  says  is  in  them. 

9  Q.  Right.  So  as  far  as  you  know,  there's  no  harm  that  you  can 

10  testify  to  from  these  leaks,  correct? 

11  A.  I  have  no  idea. 

12  Q.  Good  to  know. 

13  MS.  SHROFF:  You  can  take  that  down,  thank  you. 

14  Q.  Let  me  ask  you  this.  As  the  WikiLeaks  expert  here  today, 

15  do  you  keep  a  list  of  all  the  awards  and  recognition  that 

16  WikiLeaks  has  received  for  its  journalistic  work? 

17  A.  I  have  reviewed  all  that.  I  keep  a  list,  I  don't  keep  a 

18  record,  but  I  am  aware  of  that,  yes. 

19  Q.  You  didn't  put  it  in  a  slide  show? 

20  A.  No. 

21  Q.  How  many  times  was  WikiLeaks  nominated  for  the  Nobel  Peace 

22  Prize? 

23  A.  I  don't  know  the  number. 

24  Q.  You  are  the  WikiLeaks  expert.  You  don't  know  how  many 

25  times  it  was  nominated  for  the  Nobel  Peace  Prize? 


SOUTHERN  DISTRICT  REPORTERS,  P.C. 
(212)  805-0300 


K243SCH3 


125 


1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 

16 

17 

18 

19 

20 
21 
22 

23 

24 

25 


Rosenzweig  -  Cross 
THE  COURT:  I  guess  not. 

MS.  SHROFF:  I  withdraw  that  question,  your  Honor. 

THE  COURT:  Yes,  I'm  glad. 

Q.  Do  you  know  how  many  other  awards  WikiLeaks  has  won? 

A.  Dozens. 

Q.  Dozens.  Do  you  know  it  won  the  Amnesty  International  News 
Media  award? 

A.  Yes. 

Q.  How  many  times? 

A.  I  think  twice,  but  I'm  not  sure. 

Q.  And  do  you  know  what  it  won  for? 

A.  I'm  sorry,  what  what  was  for? 

Q.  What  was  the  award  for.  Which  disclosure;  do  you  know? 

A.  I  don't  remember. 

Q.  Didn't  put  it  in  the  slide  show? 

A.  No . 

Q.  2013,  it  won  an  award;  do  you  remember  that? 

A.  Don't  remember. 

Q.  Okay.  Mr.  Rosenzweig,  you  were  contacted  as  an  expert  for 
this  case  because  your  colleague  was  a  professor  of 
Mr.  Denton's,  correct? 

A.  That's  my  understanding.  I  don't  know  for  sure.  Yes. 

Q.  So  he  asked  his  professor,  and  his  professor  sent  him  to 
you,  and  you  were  delighted  to  make  that  introduction,  correct? 
A.  That's  my  understanding,  yes. 
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Q.  And  you  sitting  here  today  have  zero  personal  knowledge 
about  this  case,  correct? 

A.  Except  what  I've  read  in  the  indictment,  that's  correct. 

Q.  You've  never  met  Mr.  Schulte,  correct? 

A.  As  I  said,  correct. 

Q.  You've  never  spoken  to  Mr.  Schulte,  correct? 

A.  I  don't  believe  so,  no. 

Q.  Sitting  here  today,  you  have  no  idea  if  Mr.  Schulte 
accessed  any  information,  let  alone  classified  information, 
correct? 

A.  I  have  no  knowledge  of  that. 

Q.  And  sitting  here  today,  you  have  absolutely  zero  knowledge 
about  whether  or  not  Mr.  Schulte  ever  communicated  with 
WikiLeaks,  correct? 

A.  I  have  no  information  on  that. 

Q.  In  fact,  you  have  no  idea  how  Vault  7  and  Vault  8  got  to 
WikiLeaks,  correct? 

A.  I  do  not. 

MS.  SHROFF:  I  have  nothing  further. 

THE  COURT:  Mr.  Denton. 

MR.  DENTON:  Very  briefly,  your  Honor. 

REDIRECT  EXAMINATION 
BY  MR.  DENTON: 

Q.  Mr.  Rosenzweig,  Ms.  Shroff  asked  you  a  moment  ago  whether 
you  had  conducted  a  harm  analysis  in  this  case.  Do  you 
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1  remember  that? 

2  A.  Yes. 

3  Q.  Were  you  asked  to  do  that? 

4  A.  No. 

5  Q.  I  think  you  said  you  did  what  you  were  asked  to  do,  right? 

6  A.  That's  correct. 

7  Q.  What  were  you  asked  to  do? 

8  A.  I  was  asked  to  provide  the  United  States  and  the  jury  with 

9  an  overview  of  WikiLeaks,  its  history,  past  instances  in  which 

10  consequences  had  been  identified,  and  a  summary  of  the 

11  assertions  it  had  made  through  the  public  —  through  the 

12  posting  of  information  to  its  Twitter  feed. 

13  MR.  DENTON:  Ms.  Hurst,  can  we  put  up  Government 

14  Exhibit  1702  and  go  to  page  five,  please. 

15  Q.  Mr.  Rosenzweig,  do  you  remember  Ms.  Shroff  asking  you  a 

16  series  of  questions  about  time  you  spent  in  the  Heritage 

17  Foundation? 

18  A.  Correct. 

19  Q.  And  about  potential  biases  that  the  Heritage  Foundation 

20  might  have? 

21  A.  Yes. 

22  Q.  In  2010,  when  President  Felipe  Calderon  said  WikiLeaks 

23  caused  severe  damage  to  diplomatic  relations,  was  he  a  member 

24  of  the  Heritage  Foundation? 

25  A.  No. 
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Q.  You  were  asked  a  series  of  questions  about  your  time  in  the 
Bush  administration.  Do  you  remember  that? 

A.  Yes. 

Q.  Who  was  president  when  Cablegate  happened? 

A.  President  Obama  was  president  when  that  release  happened. 

Q.  Did  the  fact  that  Barack  Obama  was  president  when  this 
happened  affect  your  view  of  the  consequences  of  the 
disclosure? 

A.  No . 

Q.  Do  you  remember  Ms.  Shroff  asked  you  some  questions  about 
an  article  you  wrote  about  leaking  of  a  transcript  to  The 
Washington  Post? 

A.  Yes. 

Q.  Why  was  that  something  you  were  concerned  about? 

A.  I  was  concerned  because  too  many  people  were  leaking 
information  to  the  press  in  response  to  perceived  pressures, 
what  they  perceived  as  necessity  because  of  their  disagreement 
with  President  Trump's  views. 

My  point  was  that  even  if  you  thought  that  you  didn't 
like  President  Trump's  policy,  leaking  classified  information 
like  confidential  calls  with  —  like  the  transcripts  of 
confidential  calls  with  governments,  was  not  the  way  to  redress 
that . 

Q.  What's  problematic  about  leaking  information  like  that? 

A.  Well,  it  breaks  —  it  breaks  the  classification 
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requirements,  it's  probably  against  the  law,  and  in  the  end,  if 
we  cannot,  as  I  said  with  respect  to  the  WikiLeaks  leaks,  that 
we  were  talking  earlier,  if  we  cannot  assure  people  we  interact 
with  of  the  confidentiality  of  the  discussions,  people  stop 
talking  to  us.  It  degrades  the  government's  ability  to  act. 

MR.  DENTON:  Nothing  further,  your  Honor. 

MS.  SHROFF:  May  I,  your  Honor? 

THE  COURT:  No.  You  are  excused,  Mr.  Rosenzweig. 

MS.  SHROFF:  Your  Honor,  I  have  recross. 

THE  COURT:  Okay.  No.  Direct,  cross,  redirect.  Call 
your  next  witness. 

(Witness  excused) 

MR.  LAROCHE:  Your  Honor,  the  government  calls  Special 
Agent  Steven  Deck. 

(Continued  on  next  page) 
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STEVEN  DECK, 

called  as  a  witness  by  the  government, 
having  been  duly  sworn,  testified  as  follows: 

THE  COURT:  Go  ahead,  Mr.  Laroche. 

MR.  LAROCHE:  Thank  you,  your  Honor. 

DIRECT  EXAMINATION 
BY  MR .  LAROCHE : 

Q.  Special  Agent  Deck,  where  do  you  work? 

A.  At  the  FBI  office  here  in  New  York. 

Q.  And  how  long  have  you  worked  at  the  FBI? 

A.  Just  a  little  over  ten  years. 

Q.  What's  your  current  title? 

A.  My  current  title  is  special  agent. 

Q.  Do  you  work  within  a  particular  division  of  the  FBI? 

A.  I  do .  I  work  within  the  counterintelligence  division  here 
in  New  York. 

Q.  And  generally  speaking,  what  does  the  counterintelligence 
division  do? 

A.  So,  we're  charged  with  protecting  the  national  interest  of 
the  United  States  and  then  effecting  investigations  along  those 
lines.  So  we  essentially  investigate  foreign-intelligence 
threats  here  in  the  U.S.,  which  are  agencies,  other  countries' 
version  of  the  CIA  that  may  have  a  presence  here.  So  we 
investigate  them,  arrest  them  if  necessary,  possibly  expel  them 
from  the  country. 
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1  And  then  we  also  investigate  people  who  may  have  misused 

2  their  access  to  U.S.  information,  classified  information,  and 

3  we  call  that  espionage  investigations. 

4  Q.  Do  you  work  on  a  particular  squad  within  the 

5  counterintelligence  division? 

6  A.  I  do.  It's  called  CD-6. 

7  Q.  Generally  speaking,  what  is  an  FBI  squad? 

8  A.  It ' s  a  group  of  about  anywhere  from  approximately  six  to 

9  ten  people.  We  refer  to  them  as  squads.  Private  sector,  most 

10  of  the  time  call  them  teams.  Where  we  work,  we  address  the 

11  same  threat,  same  type  of  investigations  and  normally  have  one 

12  supervisor. 

13  Q.  You  said  you  work  on  the  squad  CD-6,  is  that  right? 

14  A.  Correct. 

15  Q.  What  does  that  squad  do? 

16  A.  So,  we're  tasked  with  investigating  espionage-related 

17  allegations,  economic  espionage,  as  well  as  unauthorized 

18  disclosures. 

19  Q.  The  unauthorized  disclosure  of  what? 

20  A.  Classified  information. 

21  Q.  Where  is  the  squad  CD-6  physically  located? 

22  A.  We're  at  the  federal  building  here  in  downtown  Manhattan. 

23  Q.  Is  that  within  the  New  York  field  office  of  the  FBI? 

24  A.  It  is. 

25  Q.  What  are  your  responsibilities  on  that  squad? 
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A.  So,  as  an  agent  on  that  squad,  we  get  leads  and  information 
from  our  office  in  general  and  potentially  other  partners  in 
the  U.S.  intelligence  agencies,  and  then  we  try  to  determine  if 
that  information  should  be  used  to  open  an  investigation,  if  it 
rises  to  a  certain  threshold.  And  then  we'll  take  that 
information  and  open  an  investigation,  which  could  mean 
conducting  interviews,  serving  legal  process,  surveillance,  to 
determine  whether  or  not  the  veracity  of  the  initial  allegation 
was  true. 

Q.  One  of  the  things  I  think  you  said  your  squad  does  is 
investigate  the  disclosure  of  classified  information,  correct? 
A.  Correct. 

Q.  What  is  classified  information? 

A.  So,  classified  information  is  U.S.  government  information 
that  could  —  if  compromised,  would  be  deemed  damaging  to  U.S. 
national-security  interests. 

Q.  Are  there  different  levels  of  classified  information? 

A.  There  are. 

Q.  What  are  they? 

A.  So,  they're  classified  at  different  levels  because  the 
contents  of  the  information  could  damage  U.S.  national-security 
interests  differently.  So  the  three  levels  are  confidential, 
secret  and  top  secret . 

Confidential  level,  if  disclosed,  could  cause  damage  to 
U.S.  interests.  Secret  could  —  is  the  next  level  up,  could 
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1  cause  serious  damage  to  the  U.S.  national-security  interests. 

2  And  then  top  secret  information,  if  compromised,  disclosed  in 

3  an  unauthorized  manner,  would  cause  exceptionally  great  damage 

4  to  the  U.S. 

5  Q.  Generally,  where  is  classified  information  stored? 

6  A.  On  either  physical  space  if  it's  a  hard-copy  document,  or 

7  on  computer  systems  that  are  rated  or  accredited  for  the  nature 

8  of  that  classification. 

9  Q.  Let's  start  with  the  physical  space.  What  type  of  physical 

10  space  stores  classified  information? 

11  A.  So,  we  can  have  secret-level  information  in  FBI  offices  or 

12  secure  FBI  space,  so  it  can  be  there.  And  then  we  also  have 

13  what's  called  our  SCIF,  so  it's  a  sensitive  compartmented 

14  information  facility  where  we  process  top  secret  information  as 

15  well  as  information  at  lower  levels  that  are  deemed  more 

16  sensitive. 

17  Q.  And  what  about  electronic  classified  information;  where  is 

18  that  stored  generally? 

19  A.  Those  are  stored  on  internal  information  systems  —  they're 

20  networks  of  computers  —  at  the  appropriate  level. 

21  Q.  What  do  you  mean  at  the  appropriate  level? 

22  A.  So,  classified  —  confidential  information  would  be  stored 

23  at  a  system  that's  rated  for  that.  Secret,  on  a  secret  system. 

24  And  a  top  secret  information  on  a  top-secret  system.  But  the 

25  higher  class  —  so  everything  under  top  secret  could  be 
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processed  on  a  top-secret  system  whereas  top  secret  processed 
on  a  secret  system  would  be  a  spill  and  in  violation  of  our 
security  policy  as  well  as  being  a  U.S.  government  clearance 
holder . 

Q.  I  think  you  used  the  word  "spill,"  is  that  correct? 

A.  Yes. 

Q.  What  did  you  mean  by  spill? 

A.  It's,  in  the  government,  what  we  describe  as  a  mishandling, 
misuse  of  —  or  storage  of  classified  information.  So  it  could 
just  be  you  taking  classified  documents  out  of  a  secured  space. 
It  could  be  you  accidentally  putting  top  secret  material  on  a 
secret  system.  It  could  also  be  secret  or  classified 
information  existing  outside  of  our  systems  that  aren't 
accredited  to  hold  them. 

Q.  Generally,  who  is  permitted  to  view  classified  information? 
A.  People  who  have  a  clearance  at  the  appropriate  level  as 
well  as  a  need  to  know. 

Q.  Let's  start  with  clearance.  What  type  of  clearance  do  you 
need? 

A.  So,  if  you  want  to  use  secret  information  and  you  have  a 
need  to  know,  you  would  need  a  secret-level  clearance.  And 
then  top  secret,  top  secret. 

Q.  How  do  you  get  a  security  clearance? 

A.  It ' s  a  variety  of  methods,  but  based  on  your  job 
qualification,  job  description,  you'll  undergo  —  for  my 
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1  position,  I  need  a  top-secret  SCI  clearance,  so  I  underwent  a 

2  background  investigation,  a  polygraph,  and  then  given  where  I 

3  work,  also  a  demonstrate  a  need  to  know  to  access  that. 

4  Q.  Do  you  hold  a  security  clearance? 

5  A.  I  do . 

6  Q.  At  what  level? 

7  A.  Top-secret  SCI. 

8  Q.  What  does  the  SCI  mean? 

9  A.  It's  sensitive  compartmented  information,  so  it's  a 

10  controlled  system  within  —  to  further  kind  of  contain  more 

11  sensitive  information,  whether  it's  at  the  secret  or  the 

12  top-secret  level. 

13  Q.  You  also  said  "a  need  to  know";  you  used  that  phrase? 

14  A.  Correct. 

15  Q.  What  do  you  mean  by  need  to  know? 

16  A.  Just  because  you  have  a  security  clearance  at  a  certain 

17  level  doesn't  mean  you're  just  granted  blanket  access  to  all 

18  information  at  that  level,  so  it's  just  a  way  to  further 

19  restrict  or  kind  of  validate  your  ability  to  view  the 

20  information. 

21  Q.  I  want  to  switch  gears  a  bit. 

22  Special  Agent  derrick,  are  you  familiar  with  the  terms 

23  "Vault  7"  and  "Vault  8"? 

24  A .  I  am . 

25  Q.  What  do  those  terms  refer  to? 
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1  A.  Those  refer  to  a  series  of  leaks  put  out  during  the  year  of 

2  2017  by  WikiLeaks  on  their  website. 

3  Q.  Do  you  have  an  understanding  of  who  the  information  that 

4  was  published  by  WikiLeaks  belonged  to? 

5  A.  Yes,  from  the  CIA. 

6  Q.  To  be  clear,  did  WikiLeaks  make  public  statements  in 

7  connection  with  those  leaks? 

8  A.  They  did. 

9  Q.  But  did  they  actually  disclose  information  with  those 

10  leaks? 

11  A.  They  did. 

12  Q.  And  how  do  you  know  that? 

13  A.  Because  I  visited  the  website  and  downloaded  the 

14  information. 

15  Q.  Approximately  how  many  separate  disclosures  of  CIA 

16  classified  information  did  WikiLeaks  make  on  its  website? 

17  A.  Approximately  26. 

18  Q.  Over  what  time  period? 

19  A.  From  around  March  2017  to  November  of  2017. 

20  Q.  Did  your  squad,  CD-6,  participate  in  that  investigation? 

21  A.  Yes,  we  did. 

22  Q.  What  was  the  extent  of  your  participation  in  the 

23  investigation? 

24  A.  So,  my  role  in  the  investigation  was  to  visit  the  WikiLeaks 

25  website  and  download  the  information  which  they  had  released 
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1  from  the  CIA  to  a  computer  so  that  we  could  document  it  for 

2  evidentiary  purposes. 

3  Q.  Let's  talk  about  how  you  downloaded  that  information. 

4  A.  OK. 

5  Q.  You  said  that  Vault  7  and  Vault  8  releases  were  posted  on 

6  WikiLeaks's  website,  is  that  correct? 

7  A.  Correct. 

8  Q.  Generally,  are  FBI  agents  permitted  to  visit  WikiLeaks's 

9  website? 

10  A.  No. 

11  Q.  Why  not? 

12  A.  Because  it  would  be  in  violation  of  our  security  policy  as 

13  well  as  being  a  clearance  holder,  you're  supposed  to  view 

14  classified  information,  which  the  releases  still  were,  still 

15  are,  on  the  correct  system,  which  viewing  it  in  the  public 

16  domain  as  a  clearance  holder  would  be  in  violation  of  that. 

17  Q.  Why  is  that  a  violation  of  your  security  policy? 

18  A.  FBI  policy,  because  you  need  to  view  classified  information 

19  on  a  classified  system  and/or  in  a  secure  space. 

20  Q.  Did  you  get  permission  to  go  to  WikiLeaks's  website  as  part 

21  of  this  investigation? 

22  A.  I  did. 

23  Q.  How  did  you  get  that  permission? 

24  A.  So,  there  was  a  conversation  between  my  squad,  my 

25  supervisor,  our  security  office  and  the  attorney's  office  to 
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1  come  up  with  a  best  method  for  the  investigation  to  download 

2  this  information. 

3  Q.  Why  did  you  talk  to  your  security  office? 

4  A.  Any  time  you're  up  against  a  security  policy  or  need  for  an 

5  investigative  measure  to  kind  of  find  a  best  practice  for  a  way 

6  to  obtain  information,  you  need  to  consult  them. 

7  Q.  And  based  on  those  discussions,  was  a  plan  put  in  place  to 

8  download  the  Vault  7  and  Vault  8  leaks? 

9  A.  It  was. 

10  Q.  What  were  some  of  the  parts  of  that  plan? 

11  A.  So,  one  of  the  parts  would  be  to  obtain  a  separate  computer 

12  that  wasn't  connected,  that  wasn't  a  previous  government 

13  computer  or  connected  to  our  network. 

14  Another  component  was  to  just  use  public  wi-fi  and  not  a 

15  government-attributable  internet  connection.  And  the  third 

16  part  would  be  to  find  the  best  way  to  store  this  unique  piece 

17  of  evidence  in  the  best  way  possible. 

18  Q.  Let's  talk  about  each  of  those  steps.  I  think  you  said 

19  that  you  got  a  nongovernment  computer,  is  that  correct? 

20  A.  Correct. 

21  Q.  Why  is  that? 

22  A.  Just  so  that  when  we  entered  it  into  evidence,  we  wouldn't 

23  be  taking  something  from  the  network  and  essentially  putting  it 

24  aside  indefinitely.  And  then  also,  we  did  not  want  to  download 

25  information  from  the  internet,  which  could  potentially  contain 
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1  viruses  or  malware,  to  an  FBI  system. 

2  Q.  Do  you  have  an  understanding  of  what  was  contained  within 

3  the  disclosures  made  by  WikiLeaks? 

4  A.  I  do. 

5  Q.  And  what  is  that  information? 

6  A.  They  were  information  about  CIA  hacking  tools  and 

7  cyber-exploitation  tools. 

8  Q.  What,  if  any,  impact  did  that  have  on  your  decision  to  use 

9  a  nongovernment  computer? 

10  A.  Anytime  you  download  something  from  the  internet,  you  take 

11  a  risk.  And  then  given  what  type  of  information  we  were  going 

12  to  acquire,  we  wanted  to  take  an  extra  —  many  extra  steps  of 

13  security  to  maintain  the  integrity  of  our  systems  as  well  as  be 

14  able  to  get  the  information  and  then  store  it  properly. 

15  Q.  I  think  the  second  part  of  the  plan  was  using  public  space 

16  to  download  the  leak.  Is  that  correct? 

17  A.  Correct. 

18  Q.  Why  didn't  you  download  the  leak  from  an  FBI  facility? 

19  A.  So,  anytime  actions  on  the  internet  are  traceable  as  well 

20  as  downloads,  and  we  didn't  want  to  use  an  FBI  system.  And 

21  given  the  type  of  information  we  were  going  to  acquire,  we 

22  didn't  want  to  use  an  FBI  system  to  download  the  information 

23  which  could  then  be  traced  back  to  us  and  potentially  implicate 

24  the  IP  address  and  potentially  other  investigations. 

25  Q.  And  why  would  that  be  problematic  for  the  FBI? 
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1  A.  Because  it  would  reveal  a  source's  methods  and  potentially 

2  negatively  impact  our  ability  to  properly  investigate  things. 

3  Q.  Did  you  identify  a  public  location  where  you  downloaded  the 

4  leak? 

5  A.  I  did. 

6  Q.  And  what  location  did  you  identify? 

7  A.  Starbucks. 

8  Q.  Why  did  you  identify  Starbucks? 

9  A.  Ease  of  use,  quick  wi-fi  and  reliability  given  the  nature 

10  of  what  we  were  doing. 

11  Q.  And  I  think  the  third  aspect  of  the  plan,  you  said,  was 

12  storing  the  computer  in  a  certain  location.  Is  that  correct? 

13  A.  Correct. 

14  Q.  Can  you  describe  that  part  of  the  plan? 

15  A.  So,  we  determined  the  best  place  would  be  the  safe  in  my 

16  supervisor's  office,  which  is  inside  our  SCIF,  which  is  where 

17  you  would  normally  store  top  secret  information.  Our  evidence 

18  locker,  where  we  —  you  know,  you  acquire  anything  related  to 

19  investigations,  drugs,  money,  we  store  there.  But  it's  only 

20  credited  to  the  secret  level,  and  this  had  some  top  secret  and 

21  SCI  information  in  it,  so  we  needed  to  find  a  solution  to  be 

22  able  to  store  it  in  the  best  manner  possible. 

23  Q.  When  did  you  first  go  to  Starbucks  to  download  the  leak? 

24  A.  In  March  of  2018. 

25  Q.  And  how  did  you  download  the  leak  once  you  were  there? 
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A.  I  went  to  the  —  used  an  internet  browser,  went  to  the 
WikiLeaks  website  first.  Didn't  really  see  a  quick  way  to 
download  all  the  —  the  large  volume  of  information,  so 
WikiLeaks  had  also  provided  a  torrent  website,  which  is 
essentially  just  —  it  was  about  15  hyperlinks  that  connected 
to  zip  files  to  download  the  bulk  of  the  information  that  they 
released . 

Q.  What  is  a  torrent  website? 

A.  It ' s  a  —  it  looked  —  just  a  blank  website,  but  it  had  15 
hyperlinks,  and  each  time  you  clicked  on  one  of  the  links,  it 
asked  if  you  wanted  to  save  the  associated  zip  file.  And  then 
I  saw  there  were  15  of  those,  and  then  I  just  downloaded  it 
that  way. 

Q.  And  what  is  a  zip  file? 

A.  Zip  file  is  just  a  way  to  compress  information.  So  if  you 
want  to  send  a  ton  of  files  over  an  email  or  kind  of  website  to 
website,  you  can  use  software  to  compress  that  information  in  a 
more  easily  storable  format. 

Q.  Why  did  you  go  to  the  torrent  instead  of  downloading  it 
directly  from  the  website? 

A.  I  did  —  I  tried  —  I  perused  the  website  for  a  little  and 
didn't  see  —  given  the  volume  of  the  information,  there 
wasn't,  to  my  appearance,  a  good  way  to  capture  all  of  it.  And 
I  knew  of  this  —  from  our  investigation  I  knew  of  this  torrent 
address,  which  had  been  provided  by  WikiLeaks  too,  if  you 
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1  wanted  to  essentially  bulk  download  all  the  information. 

2  Q.  Did  you  download  those  zip  files  to  the  computer? 

3  A.  I  did. 

4  Q.  And  were  you  able  to  unzip  those  zip  files? 

5  A.  I  was. 

6  Q.  Were  you  able  to  download  any  of  WikiLeaks's  public 

7  statements  on  that  computer? 

8  A.  I  was. 

9  Q.  And  how  did  you  do  that? 

10  A.  Via  screenshots. 

11  Q.  And  you  said  you  downloaded  the  zip  files  to  the  computer? 

12  A.  Correct. 

13  Q.  How  long  did  that  downloading  process  take? 

14  A.  Around  an  hour. 

15  Q.  And  approximately  how  much  data  was  found  on  those  zip 

16  files? 

17  A.  Approximately  1.4  gigabytes. 

18  Q.  After  you  downloaded  the  information  on  the  computer  that 

19  day,  did  the  classification  level  of  that  computer  change? 

20  A.  It  did. 

21  Q.  How  did  it  change? 

22  A.  So,  the  computer  —  we  had  just  obtained  it  from  a  store, 

23  and  it  was  just  any  other  computer  you  would  buy.  But  as  soon 

24  as  you  store  classification  —  classified  material  on  a  device 

25  like  that,  it  immediately  assumes  the  highest  classification  of 
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1  the  material  contained  within  it. 

2  Q.  Did  there  come  a  time  when  you  went  back  to  Starbucks  to 

3  download  additional  materials? 

4  A.  I  did. 

5  Q.  Approximately  when  did  that  happen? 

6  A.  In  May  of  2018. 

7  Q.  And  why  did  you  go  back  to  download  additional  materials? 

8  A.  Through  the  investigation,  we  determined  that  the  zip  files 

9  which  I  had  downloaded  contained  Vault  7,  but  it  did  not 

10  contain  the  Vault  8  release,  and  we  wanted  to  capture  the 

11  entirety  of  what  WikiLeaks  had  put  out  there  from  March  2017  to 

12  November  of  2017. 

13  Q.  Were  you  able  to  download  Vault  8  when  you  went  back? 

14  A.  I  was. 

15  Q.  How  did  you  do  that? 

16  A.  So,  it  was  a  lot  less  information.  I  was  able  to  just  go 

17  to  the  release  that  WikiLeaks  specified  as  Vault  8  and  download 

18  the  singular  files  in  that  way.  It's  just  —  it's  a  kind  of 

19  like  right  click,  save  as. 

20  Q.  And  did  you  download  the  Vault  8  leak  on  the  same  computer 

21  that  you  downloaded  the  Vault  7  leaks? 

22  A.  I  did. 

23  Q.  Did  there  come  a  time  when  you  confirmed  that  you  had 

24  downloaded  all  of  the  Vault  7  and  Vault  8  leaks  onto  that 

25  computer? 
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1  A.  I  did. 

2  Q.  How  did  you  do  that? 

3  A.  So,  I  matched  —  the  first  release  on  March  7  is  a  long  web 

4  page  of  about  a  few  thousand  embedded  hyperlinks,  so  I  went  to 

5  WikiLeaks's  website.  I  scrolled  through  that  to  see  if  what  I 

6  had  downloaded  appeared  to  be  the  same.  And  it  did.  And  then 

7  all  of  the  subsequent  leaks  were  essential  —  like  a  one-  to 

8  two-page  summary  of  what  WikiLeaks  was  going  to  release  in 

9  addition  to  the  provided  original  documents  from  the  CIA.  So  I 

10  clicked  through  on  WikiLeaks's  website  each  of  their  press 

11  releases,  made  sure  I  had  those,  and  then  also  made  sure  that 

12  in  the  downloads  I  had  appeared  each  of  the  documents  which 

13  WikiLeaks  had  embedded. 

14  MR.  LAROCHE:  Your  Honor,  may  I  approach? 

15  THE  COURT:  Yes. 

16  BY  MR.  LAROCHE: 

17  Q.  Special  Agent  Deck,  one  of  the  things  I've  handed  you  is 

18  marked  Government  Exhibit  1.  Do  you  recognize  that? 

19  A.  I  do. 

20  Q.  And  what  is  it? 

21  A.  That's  the  computer  I  used  to  download  the  Vault  7  and 

22  Vault  8  releases. 

23  Q.  And  how  do  you  know  it's  that  computer? 

24  A.  I  purchased  it.  I  used  it,  and  it  had  been  stored  in  our 

25  space. 
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MR.  LAROCHE:  Your  Honor,  the  government  offers 

2 

Government  Exhibit  1  into  evidence. 

3 

MR.  BRANDEN :  No  objection.  Judge. 

4 

THE  COURT:  No.  1  will  be  received  in  evidence. 

5 

MR.  LAROCHE:  Thank  you,  your  Honor. 

6 

(Government  Exhibit  1  received  in  evidence) 

7 

BY  MR .  LAROCHE : 

8 

Q.  Special  Agent  Deck,  can  you  just  hold  that  up  for  the  jury 

9 

to  see. 

10 

Special  Agent  Deck,  I've  also  handed  you  a  binder  that 

11 

contains  Government  Exhibits  2  through  16.  Do  you  recognize 

12 

that? 

13 

A.  I  do . 

14 

Q.  And  have  you  reviewed  this  binder? 

15 

A.  I  have. 

16 

Q.  And  how  do  you  know  you've  reviewed  it? 

17 

A.  Excuse  —  sorry.  Sorry. 

18 

Q.  How  do  you  know  you've  reviewed  it? 

19 

A.  Oh.  Because  I've  reviewed  the  binder  and  also  on  the 

20 

material  that  I  downloaded. 

21 

Q.  And  what  is  contained  in  Government  Exhibits  2  through  16? 

22 

A.  Information  related  to  the  Vault  7  release. 

23 

Q.  And  is  that  contained  within  Government  Exhibit  1? 

24 

A.  It  is. 

25 

MR.  LAROCHE:  Your  Honor,  the  government  would  offer 
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1 

Government  Exhibits  2  through  16  into  evidence. 

2 

MR.  BRANDEN :  No  objection.  Judge. 

3 

THE  COURT:  They're  received  in  evidence,  2  through 

4 

16  . 

5 

MR.  LAROCHE:  Thank  you,  your  Honor. 

6 

(Government  Exhibits  2-16  received  in  evidence) 

7 

MR.  LAROCHE:  You  can  put  that  to  the  side  for  a 

8 

second . 

9 

Ms.  Hurst,  can  you  please  publish  to  the  parties,  the 

10 

jury  and  the  Court  what  is  marked  as  Government  Exhibit  2. 

11 

Q.  Special  Agent  Deck,  do  you  recognize  Government  Exhibit  2 

12 

on  your  screen? 

13 

A.  I  do . 

14 

Q.  What  is  this  showing? 

15 

A.  This  is  a  screenshot  from  the  release  on  March  7.  It's 

16 

showing  part  of  the  Confluence  software  which  was  used,  and 

17 

it's  kind  of  a  joint  project,  collaboration  software.  So  it 

18 

would  appear  —  this  release  was  a  very  long  web  page  with  a 

19 

lot  of  links  taking  —  that  would  go  to  their  associated 

20 

address.  And  this  is  just  a  snippet  of  that. 

21 

Q.  And  you  said  March  7.  March  7  of  what  year? 

22 

A.  2017. 

23 

Q.  And  was  this  the  first  leak  posted  by  WikiLeaks? 

24 

A.  It  was. 

25 

Q.  And  you  said  that  there  was  a  long  list  on  this  page,  is 
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1 

that  correct? 

2 

A.  Correct. 

3 

Q.  Where  would  that  list  appear  if  you  were  on  the  website? 

4 

A.  If  you  would  just  keep  scrolling. 

5 

Q.  Scrolling  in  which  direct? 

6 

A.  Down. 

7 

Q.  And  where  would  that  list  appear? 

8 

A.  Under  directory  departments,  branches  and  groups. 

9 

Q.  And  could  you  click  on  parts  of  the  list? 

10 

A.  You  could. 

11 

Q.  What  would  happen  if  you  clicked  on  parts  of  the  list? 

12 

A.  It  would  take  you  to  whatever  associated  page  that  was. 

13 

Q.  And  did  you  download  the  information  by  clicking  on  those 

14 

parts? 

15 

A.  I  did  not. 

16 

Q.  Why  not? 

17 

A.  It  was  too  cumbersome  and  time-consuming,  especially  when 

18 

we  had  the  torrent  address  provided,  which  had  been  provided  by 

19 

WikiLeaks's  Twitter,  verified  Twitter  account. 

20 

Q.  And  you  said  cumbersome.  Approximately  how  many  links  were 

21 

on  this  first  March  7  leak? 

22 

A.  Over  a  few  thousand. 

23 

MR.  LAROCHE:  Ms.  Hurst,  can  you  publish  Government 

24 

Exhibit  3 . 

25 

Q.  Special  Agent  Deck,  do  you  recognize  Government  Exhibit  3? 
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1  A.  I  do. 

2  Q.  What  is  this  showing? 

3  A.  This  is  a  continuation  of  the  release  on  March  7  and  the 

4  Confluence  page.  So  just  imagine  you  keep  scrolling  down  like 

5  a  WikiLeaks  —  or  a  Wikipedia  page  or  any  sort  of  very 

6  hyperlinked,  content-heavy  web  page,  and  this  is  what  that 

7  represents. 

8  Q.  Did  each  of  the  lines  on  this  page  link  to  something  else? 

9  A.  They  do. 

10  Q.  What  would  happen  if  you  clicked  on  one  of  these  links? 

11  A.  It  would  take  you  to  whatever  associated  web  page  was 

12  embedded  there. 

13  Q.  And  again,  this  is  from  the  March  7  leak,  is  that  correct? 

14  A.  Correct. 

15  MR.  LAROCHE:  Ms.  Hurst,  can  you  please  publish 

16  Government  Exhibit  6. 

17  Q.  And  again,  what  is  this  showing? 

18  A.  Continuation  of  the  March  7  release,  and  what  you  would  see 

19  is  in  the  Confluence  software  if  you're  on  there  for  joint 

20  project  collaboration. 

21  MR.  LAROCHE:  Ms.  Hurst,  can  you  please  publish 

22  Government  Exhibit  6-1. 

23  Q.  What  is  this  exhibit  showing? 

24  A.  So,  this  is  a  screenshot  of  —  continuing  from  Confluence 

25  of  the  transferring  data  using  NTES  viewed  previously  —  on  the 
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1  previous  exhibit  if  you  had  clicked  on  that  hyperlink. 

2  MR.  LAROCHE:  Ms.  Hurst,  if  you  can,  could  we  please 

3  put  Government  Exhibits  6  and  6-1  next  to  each  other. 

4  Q.  I'm  sorry.  You  said  that  if  you  clicked  on  one  side  of  the 

5  left  link,  it  would  bring  you  to  the  right,  is  that  correct? 

6  A.  Correct.  If  you  —  the  third-f rom-the-top  link,  if  you  had 

7  clicked  on  that,  it  would  have  taken  you,  depending  how  you  had 

8  it  set  up,  either  a  new  tab  or  the  same  web  page,  but  it  would 

9  have  the  information  which  it  described. 

10  MR.  LAROCHE:  Let's  zoom  in  on  that.  If  we  can  go  to 

11  Government  Exhibit  6  again  and  then  zoom  in  on  the  third  line 

12  down,  please. 

13  Q.  Is  that  the  link  you're  referring  to? 

14  A.  Correct. 

15  MR.  LAROCHE:  Now  we  can  go  back  to  Government  Exhibit 

16  6-1.  Let's  first  focus  on,  please  zoom  in  on  the  line  that 

17  starts  "transferring  data." 

18  Q.  And  that's  tied  to  the  link  from  the  previous  page,  is  that 

19  correct? 

20  A.  Correct. 

21  MR.  LAROCHE:  If  you  can  zoom  out  again,  please. 

22  Q.  Special  Agent  Deck,  I  want  to  focus  you  on  the  banner  in 

23  the  middle  that  says  secret /noforn . 

24  MR.  LAROCHE:  If  we  could  zoom  in  on  that,  please. 

25  Q.  Do  you  recognize  that  banner? 
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1 

A.  I  do . 

2 

Q.  And  what  is  it? 

3 

A.  It ' s  a  classification  banner  at  the  secret  level,  and  it 

4 

has  —  the  noforn  is  a  dissemination  caveat.  Essentially  — 

5 

there's  a  lot  of  those,  but  this  one  means  that  it  is  for  U.S. 

6 

government  personnel  only,  not  to  be  disseminated  outside  the 

7 

government . 

8 

Q.  Did  you  put  the  banner  on  this  page? 

9 

A.  I  did  not. 

10 

Q.  Was  this  banner  present  when  you  downloaded  it  from 

11 

WikiLeaks  ? 

12 

A.  It  was. 

13 

MR.  LAROCHE:  Ms.  Hurst,  you  can  take  that  exhibit 

14 

down . 

15 

Q.  Special  Agent  Deck,  we  talked  about  three  exhibits  from  the 

16 

leak,  I  believe.  Government  Exhibits  2,  3  and  6.  Is  that 

17 

correct? 

18 

A.  Uh-huh. 

19 

Q.  And  all  of  those  came  from  the  March  7  leak,  right? 

20 

A.  Correct. 

21 

Q.  And  that  was  the  first  disclosure  made  by  WikiLeaks? 

22 

A.  That's  correct. 

23 

Q.  How,  if  at  all,  were  the  subsequent  disclosures  by 

24 

WikiLeaks  different? 

25 

A.  So,  I  described  that  release  as  just  a  very  long  web  page 
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of  a  kind  of  collaboration  site,  similar  to  how  —  ton  of  links 

2 

to,  like,  a  Wikipedia  page.  All  the  other  releases  were  a  one- 

3 

to  two-page  summary  by  WikiLeaks  of  what  they  were  going  to 

4 

release.  And  then  next  to  the  article  —  next  to  their 

5 

summary,  they  would  have  all  of  the  original  CIA  documents. 

6 

MR.  LAROCHE:  Ms.  Hurst,  can  you  please  publish 

7 

Government  Exhibit  13. 

8 

Q.  Special  Agent  Deck,  do  you  recognize  this? 

9 

A.  I  do. 

10 

Q.  And  what  is  this? 

11 

A.  This  is  a,  the  Brutal  Kangaroo  user  guide. 

12 

Q.  What  leak  was  this  from? 

13 

A.  This  was  on  or  about  June  22,  2017. 

14 

MR.  LAROCHE:  Let's  start  at  the  top  of  the  page,  if 

15 

we  could  zoom  in  on  the  secret /noforn . 

16 

Q.  What  is  that? 

17 

A.  That's  the  banner  classification  identifying  this  document 

18 

at  the  secret /noforn  level. 

19 

Q.  And  again,  did  you  put  the  banner  on  this  document? 

20 

A.  I  did  not. 

21 

Q.  Was  this  banner  on  the  document  when  you  downloaded  it? 

22 

A.  It  was. 

23 

MR.  LAROCHE:  If  you  could  zoom  out  again,  please,  and 

24 

then  zoom  in  on  the  three  lines  starting  "Brutal  Kangaroo 

25 

program. " 
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K24Wsch4  Deck  -  Direct 

Q.  Are  you  familiar  with  these  terms? 

A .  I  am . 

Q.  How  are  you  familiar  with  them? 

A.  From  my  knowledge  on  the  investigation,  I  know  that  Brutal 
Kangaroo  was  a  cyber  tool  developed  and  used  by  the  CIA. 

MR.  LAROCHE:  Put  up  page  4  of  the  PDF,  please, 

Ms.  Hurst,  and  if  we  could  just  zoom  in  from  the  top  down  to 
the  paragraph  that  has  an  S,  "the  Brutal  Kangaroo  project 
consists  of . " 

Perfect.  Thank  you. 

Q.  First,  let's  just  start  with,  there's  a  1  and  then  U  in 
parentheses  and  scope.  What  does  that  U  in  parentheses  mean? 
A.  That  means  unclassified. 

Q.  Are  you  familiar  with  those  markings  on  classified 
documents  ? 

A.  I  am. 

Q.  Just  generally,  what  do  they  designate? 

A.  So,  if  the  overall  classification  of  the  document,  which, 
as  you  saw,  was  the  banner  line  at  the  top  and  the  bottom, 
classifies  it  as  secret  or  top  secret,  then  even  though  —  if 
there  is  unclassified  information  in  the  document,  you  must 
delineate  it  as  unclassified.  Or  you  must  portion  mark  all 
information  regardless  of  what  it's  classified  at. 

Q.  There's  a  1.1  that  reads,  "System  overview  and  description 
of  Brutal  Kangaroo  tool  suite."  Can  you  read  the  paragraph 
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K24Wsch4  Deck  -  Cross 

below  that? 

A.  "Brutal  Kangaroo  is  a  tool  suite  for  targeting  closed 
networks  by  air  gap  jumping  using  thumb  drives.  Brutal 
Kangaroo  components  create  a  custom  covert  network  within  the 
target  closed  network  and  provide  a  functionality  for  executing 
surveys,  directory  listings  and  arbitrary  executables." 

MR.  LAROCHE:  Thank  you.  No  further  questions. 

THE  COURT:  Mr.  Branden. 

CROSS-EXAMINATION 
BY  MR.  BRANDEN: 

Q.  Special  Agent  Deck,  I'm  Jim  Branden.  I'm  a  defense 
attorney  for  Mr.  Schulte.  I  just  have  a  few  questions  for  you. 
A.  OK. 

Q.  First  of  all,  in  March  and  May  of  2018,  on  two  specific 
dates,  you  were  tasked  with  essentially  downloading  Vaults  7 
and  8  from  the  WikiLeaks  website,  correct? 

A.  Correct. 

Q.  And  then  as  a  result  of  downloading  those  Vault  7  and  Vault 
8,  you  were  able  to  produce  to  the  government  exhibits  1  and 
then  2  through  16  which  were  introduced  here  today,  correct? 

A.  Correct. 

Q.  OK.  And  exhibit  1  is  the  computer  that  you  bought  and  then 
used  at  Starbucks,  correct? 

A.  Correct. 

Q.  OK.  Nothing  in  the  exhibits  that  were  introduced  on  direct 
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K24Wsch4  Deck  -  Cross 

through  you  would  show  how  that  information,  the  Vaults  7  and  8 
information,  was  originally  provided  to  WikiLeaks,  is  that 
correct? 

A.  Correct. 

Q.  Is  it  also  true  that  nothing  in  those  exhibits  would  show 
when  that  information  was  provided  to  WikiLeaks? 

A.  Not  —  not  to  my  knowledge. 

Q.  And  finally,  nothing  in  those  exhibits  or  through  your 
investigation  would  specifically  show  who  provided  the  Vault  7 
and  Vault  8  information  to  WikiLeaks? 

A.  Yeah.  Not  to  my  knowledge. 

MR.  BRANDEN :  That's  all  I  have.  Judge.  Thank  you 
very  much. 

THE  COURT:  All  right. 

MR.  LAROCHE:  Nothing  further  for  this  witness,  your 

Honor . 

THE  COURT:  You're  excused.  Thank  you  very  much. 

THE  WITNESS:  Thank  you,  your  Honor. 

(Witness  excused) 

THE  COURT:  Call  your  next  witness. 

MR.  LAROCHE:  Your  Honor,  may  we  approach? 

THE  COURT:  Yes. 

(Continued  on  next  page) 
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(At  sidebar) 

THE  COURT:  You're  going  to  tell  me  that  it's  a 
classified  witness  and  you  don't  want  to  start  at  quarter  to 
three . 

MR.  LAROCHE:  It's  not  that  we  don't  want  to  start. 

It  just  takes  some  time  to  get  him  up  here.  The  problem  is 
with  the  marshals,  it  takes  some  time  to  get  up  here. 

MS.  SHROFF:  Your  Honor,  may  I  just  ask  why  it's 
necessary  for  the  marshal  to  escort  him  to  his  seat?  It 
doesn't  seem  needed. 

THE  COURT:  Access  to  the  elevator  is  through  the 
marshal's  office. 

MS.  SHROFF:  Yes,  but  the  marshal  doesn't  have  to  walk 
him  into  the  courtroom. 


MR.  LAROCHE:  They  have  to  bring  him  up  through  that 
access  route,  which  I  think  takes  some  time. 

MS.  SHROFF:  No,  I  don't  care  when  you  start.  I  just 
don't  want  the  marshal,  or  whoever  it  is,  walking  him  in. 

THE  COURT:  They're  going  to  walk  through  the  door. 
The  marshals  aren't  going  to  escort  him  through  the  courtroom. 


MR .  LAROCHE :  No . 

THE  COURT:  He's  going  to  open  the  door  for  him. 

MR.  LAROCHE:  Yes. 

MS.  SHROFF:  This  door,  the  marshal's  door?  This  one? 
MR.  LAROCHE:  We  can  confirm  that,  but  that's  our 
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understanding.  I  don't  think  he's  going  to  walk  him  to  the 
chair . 

THE  COURT:  Why  would  he  walk  him  to  the  chair? 

MR.  LAROCHE:  I  don't  think  so. 

MS.  SHROFF:  So  we're  going  to  start  him  tomorrow? 

MR.  LAROCHE:  I  think  it  makes  sense.  By  the  time  he 
gets  up  here,  it's  going  to  be  three. 

THE  COURT:  Listen,  you  have  to  do  a  better  job  of 
getting  your  witnesses  up  here.  We're  not  going  to  waste  15 
minutes  every  time  you  have  a  witness.  You  can  stick  him  in 
the  witness  room. 

MS.  SHROFF:  You  don't  know  who  they  are,  right?  It's 
kind  of  hard  to  accost  somebody  when  you  don't  know  who  they 
are.  Just  saying. 

MR.  LAROCHE:  Well,  you  never  know. 

Understood,  Judge. 

(Continued  on  next  page) 
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(In  open  court) 

THE  COURT:  All  right.  The  parties  agreed  to  adjourn 
for  the  day,  so  we're  going  to  close.  Normally  we'd  end  at 
3:00.  We're  going  to  end  a  little  bit  sooner. 

You  heard  what  I  said.  Don't  do  any  research  on  the 
case.  Don't  talk  about  the  case.  Keep  an  open  mind. 

We'll  resume  tomorrow  morning  at  9:00.  Try  to  be  on 
time.  We'll  have  breakfast  and  a  little  snack,  a  reward  for 
coming  early.  We'll  get  started  at  nine  and  we'll  break  at 
3:00  for  the  day. 

Thank  you  very  much.  Safe  home  tonight. 

(Continued  on  next  page) 
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(Jury  not  present) 

THE  COURT:  OK.  Please  be  seated. 

Anything  you  want  to  take  up? 

Mr.  Laroche. 

MR.  LAROCHE:  No,  your  Honor. 

THE  COURT:  Ms.  Shroff. 

MS.  SHROFF:  No,  your  Honor. 

THE  COURT:  All  right.  See  you  tomorrow  morning  at 

9:00. 

Will  the  first  witness  tomorrow  have  protective 
measures  coming  in? 

MR.  LAROCHE:  Yes,  your  Honor. 

THE  COURT:  Limit  the  attendance  of  the  courtroom. 

MR.  LAROCHE:  Yes,  your  Honor. 

THE  COURT:  And  you'll  take  care  of  that? 

MR.  LAROCHE:  Yes,  your  Honor. 

THE  COURT:  How  are  you  going  to  do  that? 

MR.  LAROCHE:  We'll  consult  with  Mr.  Gonzalez  before 
and  make  sure  everybody's  on  the  same  page. 

THE  COURT:  Consult  with  the  marshal's  office  as  well. 
MR.  LAROCHE:  Yes,  your  Honor. 

THE  COURT:  And  be  mindful  of  what  I  say. 

MR.  LAROCHE:  Yes,  your  Honor. 

THE  COURT:  Get  the  witnesses  subject  to  protection  up 
here  so  that  we  don't  have  to  wait  15  minutes  for  the  elevator. 
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MR.  LAROCHE:  Yes,  your  Honor. 
THE  COURT:  Thank  you. 

MR.  LAROCHE:  Yes,  your  Honor. 
(Adjourned  to  Eebruary  5,  2020, 


Understood . 


at  9:00  a .m. ) 
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